Joomla! Documentation - User contributions [en]

Making single installation packages for Joomla! 1.5 and 2.5 series

2011-11-21T11:05:25Z

Hidabe: /* Obsolte code */

{{review}}

It is possible to create a single installation package which can install a component in Joomla! 1.5, 1.6 and 1.7 with minor changes. Below you will find some of the most common tricks required to create an extension which is compatible with all current versions of the Joomla! CMS.

== Dealing with API changes ==
You will regularly bump into cases where an API has changed between Joomla! 1.5, 1.6 and 1.7. In order to cater for them, you need to run slightly different code based on the Joomla! version. Right now it's possible to do that by writing conditional statements like this:

<source lang="php">
if(version_compare(JVERSION,'1.7.0','ge')) {
// Joomla! 1.7 code here
} elseif(version_compare(JVERSION,'1.6.0','ge')) {
// Joomla! 1.6 code here
} else {
// Joomla! 1.5 code here
}
</source>

If you do not have Joomla! 1.7-specific code -i.e it is the same as the Joomla! 1.6-specific code- please use the following code:

<source lang="php">
if(version_compare(JVERSION,'1.6.0','ge')) {
// Joomla! 1.6 code here
} else {
// Joomla! 1.5 code here
}
</source>

While this conditional statement looks like an overkill, it has two major advantages:
* Compatibility with all Joomla! versions using the same package, therefore using the same codebase, ergo less maintenance overhead
* Once, let's say, Joomla! 1.8 is released and you decide to drop support for earlier Joomla! releases, we can just search your code for "if(version_compare(JVERSION," and remove all of the legacy code.

== One XML configuration file, multiple Joomla! versions ==

Various XML files in Joomla! accept settings, or parameters. For example your extension manifest file, the config.xml file and the view XML files all accept such settings. You may have noticed that whereas in Joomla! 1.5 these were found under the <params> tags, in Joomla! 1.6 and later they are found inside <filedsets>. One hidden secret of Joomla! is that Joomla! 1.5 will ignore Joomla! 1.6 syntax, whereas Joomla! 1.6/1.7 will ignore Joomla! 1.5 syntax. This allows you to have a single XML file which caters for all Joomla! releases. For example, here's a sample config.xml file, to be placed in the component's backend directory:

<source lang="xml">
<?xml version="1.0" encoding="utf-8"?>
<config>

<params>
<param name="foobar" type="text" default="" size="30"
label="COM_FOOBAR_OPTION_FOOBAR_LBL"
description ="COM_FOOBAR_OPTION_FOOBAR_DESC" />
</params>


<fieldset
name="basic"
label="COM_FOOBAR_OPTIONS_SECTION_BASIC_LBL"
description="COM_FOOBAR_OPTIONS_SECTION_BASIC_DESC"
>
<field name="foobar" type="text" default="" size="30"
label="COM_FOOBAR_OPTION_FOOBAR_LBL"
description ="COM_FOOBAR_OPTION_FOOBAR_DESC" />
</fieldset>
</config>
</source>

That's how easy it is!

== Dealing with languages ==

=== How to load component-local translation files in Joomla! 1.5 ===

Joomla! 1.6 introduced a new feature where a user can place language files inside the component's directory, e.g. administrator/com_foobar/language/en-GB/en-GB.com_foobar.ini, in order to provide language overrides. But Joomla! 1.5 doesn't support this feature. Or does it? Even though it can not do that automatically, you can do so in your extension's dispatcher file, e.g. administrator/com_foobar/foobar.php. Here's the magic code to do that in the backend:
<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, null, true);
$jlang->load('com_foobar', JPATH_COMPONENT_ADMINISTRATOR, null, true);
</source>
and the frontend:
<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_SITE, null, true);
$jlang->load('com_foobar', JPATH_COMPONENT, null, true);
</source>

=== Tips and tricks for language strings ===

All your translation keys should consist of uppercase characters without spaces (that is A-Z, 0-9 and underscores). All translation values should be included in double quotation marks. This allows the translation files to be parsed by Joomla! 1.5/1.6/1.7 alike. You are also suggested to prefix your translation keys with the extension's name, albeit this is not required. For example, this is a good translation string:
COM_FOOBAR_CPANEL_TITLE="Foobar Control Panel"
whereas this is a '''bad''' translation string:
CONTROL PANEL=Foobar Control Panel
The former works with all current versions of Joomla!, the latter doesn't.

If you have double quotation marks in your translation values, please replace them with single quotation marks. While Joomla! 1.5 allowed escaping the double quotation marks with \", Joomla! 1.6 under newer versions of PHP don't and require you to escape them as "__QQ__" which throws off Joomla! 1.5's parser. The workaround is to take advantage of a little known fact about HTML, that attributes can be wrapped in single quotation marks. For instance, change this:
COM_FOOBAR_SOME_KEY=<a href="http://www.example.com">Just a test</a>
to this:
COM_FOOBAR_SOME_KEY="<a href='http://www.example.com'>Just a test</a>"
It is valid HTML, it works on Joomla! 1.5/1.6/1.7 but it will invalidates XHTML. You can't always win, sorry.

=== Making untranslated strings look more beautiful ===

The problem with using tight translation keys as we described is that untranslated strings now look something like COM_FOOBAR_VIEWNAME_SOMEKEY. If you have volunteer translators you can bet your head that most translations will not be in sync with your component and you will have untranslated strings. In Joomla! 1.5, using "natural language" keys, you got to show your users the default (English) text if a translation key didn't exist in their language. This is impossible in Joomla! 1.6... or maybe not?

We can use the same little trick in our component's dispatcher as with our component-local translation loading string above. Here's how to load the English translation file in the backend of your component, then overwrite only the keys which exist with the user's selected language, essentially allowing untranslated keys to show in English:

<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, 'en-GB', true);
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, null, true);
</source>

The same thing in the front-end:

<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_SITE, 'en-GB', true);
$jlang->load('com_foobar', JPATH_SITE, null, true);
</source>

== JElement vs JFormField ==

Oh, the struggle! You need a custom widget in the configuration section of your component. In Joomla! 1.5 you could just create a new JElement. In Joomla! 1.6 you could just create a new JFormField. But both? In a single file? You can employ a simple trick. In the following example I am going to create a rather lame element, called SQL2, which displays a multi-selection box out of the results of a SQL statement. This is made as part of a fictitious module called mod_foobar

First, let your configuration know where to load the custom widget files from, by putting this in your module's XML manifest file:

<source lang="xml">
<params addpath="/modules/mod_foobar/elements">
<param name="ids" type="sql2" default=""
label="MOD_FOOBAR_LEVELS_TITLE"
description="MOD_FOOBAR_LEVELS_DESC"
query="SELECT `foobar_level_id`, `title` FROM `#__foobar_levels`"
key_field="foobar_level_id"
value_field="title" />
</params>

<config addfieldpath="/modules/mod_foobar/elements">
<fields name="params">
<fieldset name="basic">
<field name="ids" type="sql2" default=""
label="MOD_FOOBAR_LEVELS_TITLE"
description="MOD_FOOBAR_LEVELS_DESC"
query="SELECT `foobar_level_id`, `title` FROM `#__foobar_levels`"
key_field="foobar_level_id"
value_field="title" />
</fieldset>
</fields>
</config>
</source>

As you see, we instruct both Joomla! 1.5 and 1.6/1.7 to look into the same directory, for the same-named file (sql2.php). Here are the contents of the modules/mod_foobar/elements/sql2.php file:

<source lang="php">
defined('_JEXEC') or die('Restricted Access');

/*
* This trick allows us to extend the correct class, based on whether it's Joomla! 1.5 or 1.6
*/
if(!class_exists('JFakeElementBase')) {
if(version_compare(JVERSION,'1.6.0','ge')) {
class JFakeElementBase extends JFormField {
// This line is required to keep Joomla! 1.6/1.7 from complaining
public function getInput() {}
}
} else {
class JFakeElementBase extends JElement {}
}
}

/**
* Our main element class, creating a multi-select list out of an SQL statement
*/
class JFakeElementSQL2 extends JFakeElementBase
{
var $_name = 'SQL2';

// Joomla! 1.5
function fetchElement($name, $value, &$node, $control_name)
{
$db = & JFactory::getDBO();
$db->setQuery($node->attributes('query'));
$key = ($node->attributes('key_field') ? $node->attributes('key_field') : 'value');
$val = ($node->attributes('value_field') ? $node->attributes('value_field') : $name);
return JHTML::_('select.genericlist', $db->loadObjectList(), ''.$control_name.'['.$name.'][]', 'class="inputbox" multiple="multiple" size="5"', $key, $val, $value, $control_name.$name);
}

// Joomla! 1.6
function getInput()
{
$db = & JFactory::getDBO();
$db->setQuery($this->element['query']);
$key = ($this->element['key_field'] ? $this->element['key_field'] : 'value');
$val = ($this->element['value_field'] ? $this->element['value_field'] : $this->name);
return JHTML::_('select.genericlist', $db->loadObjectList(), $this->name, 'class="inputbox" multiple="multiple" size="5"', $key, $val, $this->value, $this->id);
}
}

/*
* Part two of our trick; we define the proper element name, depending on whether it's Joomla! 1.5 or 1.6
*/
if(version_compare(JVERSION,'1.6.0','ge')) {
class JFormFieldSQL2 extends JFakeElementSQL2 {}
} else {
class JElementSQL2 extends JFakeElementSQL2 {}
}
</source>

Considering that most custom widgets have a lot more code than this, you can create two different initialisation sections for Joomla! 1.5 and 1.6/1.7 (fetchElement and getInput), populate class variables, then call a big, common method to render the bulk of the widget (just like we did with JHTML's genericlist in the example above). This will eliminate the need to rewrite the same code over again just to cater for a new Joomla! version.

== Obsolte code ==

Joomla 1.6 / 1.7 have been left any code obsolete, we should review code for do compatible with all versions.
=== Global Mainframe ===
Bad: <source>global $mainframe;</source>
Good: <source>$mainframe = &JFactory::getApplication();</source>

=== Global Option ===
Bad: <source>global $option;</source>
Good: <source>$option = JRequest::getCmd('option');</source>

I will add more changes like it.

== Content plugins work slightly different ==

The content plugins in Joomla! 1.5 were using the onPrepareContent method, whereas the content plugins in Joomla! 1.6/1.7 use the onContentPrepare method. The arguments have also changed. You can, however, create a single content plugin which runs on both Joomla! versions without rewriting code. Here's how:

<source lang="php">
defined('_JEXEC') or die();

jimport('joomla.plugin.plugin');

class plgContentFoobar extends JPlugin
{
public function onPrepareContent( &$article, &$params, $limitstart = 0 )
{
$article->text = $this->doSomethingWith($article->text);
}

public function onContentPrepare($context, &$row, &$params, $page = 0)
{
// Danger, Will Robinson! $row in Joomla! 1.6/1.7 may be a string, not an article object!
if(is_object($row)) {
return $this->onPrepareContent($row, $params, $page);
} else {
$row = $this->doSomethingWith($row);
}

return true;
}

private function doSomethingWith($text)
{
// Apparently, you have to do something here ;)
return $text;
}
}
</source>

== Updating doesn't work as you'd expect ==

There is a small but very disturbing bug in Joomla! 1.6. Updating a component whose manifest XML states version="1.5.0" doesn't allow you to run the SQL statements. Namely, the SQL files you specify under the "<install><sql>" tags won't run. You can neither use the new "<update>" tag. You are stuck with no way to run SQL commands on component update!

The ugly workaround is to create a file named script.foobar.php with the following contents:

<source lang="php">
<?php
define('_JEXEC') or die();

class Com_FoobarInstallerScript {

function update($parent) {
$db = JFactory::getDBO();
// Obviously you may have to change the path and name if your installation SQL file ;)
if(method_exists($parent, 'extension_root')) {
$sqlfile = $parent->getPath('extension_root').DS.'install.sql';
} else {
$sqlfile = $parent->getParent()->getPath('extension_root').DS.'install.sql';
}
// Don't modify below this line
$buffer = file_get_contents($sqlfile);
if ($buffer !== false) {
jimport('joomla.installer.helper');
$queries = JInstallerHelper::splitSql($buffer);
if (count($queries) != 0) {
foreach ($queries as $query)
{
$query = trim($query);
if ($query != '' && $query{0} != '#') {
$db->setQuery($query);
if (!$db->query()) {
JError::raiseWarning(1, JText::sprintf('JLIB_INSTALLER_ERROR_SQL_ERROR', $db->stderr(true)));
return false;
}
}
}
}
}
}
</source>

Reference that file in the end of your manifest XML file, just above the closing install tag, with:
<source type="xml">
<scriptfile>script.foobar.php</scriptfile>
</source>

This will force Joomla! 1.6 to run your extension's installation SQL file during the component update, just like Joomla! 1.5 used to do. Enjoy!

== Menu item creation tricks ==

===For Joomla! 1.5===

You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration><code> tag.

<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>
or
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">Example Component</menu>
</source>

In both cases, you need to create a file named en-GB.com_example.menu.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation). In the first case (using a translation key), its contents should be:
<source>
COM_EXAMPLE=Example Component
</source>
In the second case (using natural language strings) its contents should be
<source>
Example Component=Example Component
</source>

NB: Joomla! 1.5 sorts the Component menu items based on the key you supply in your XML manifest. If you use the COM_EXAMPLE approach, your component will be sorted with all the components beginning with "C", e.g. just before Contacts on a fresh Joomla! 1.5 installation, no matter what the translation is! This leads to funny results, especially with non-English languages where the translated component names do not follow the same sorting order as their English names. If you are bilingual or multilingual, I think you know what I mean…

===For Joomla! 1.6 and later versions===

You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration></code> tag.
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>

You can not use a natural language string. Doing so will result in your component name appearing as example-component in the menu and you will be unable to provide a translation.

You need to create a file named en-GB.com_example.sys.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation) or in administrator/components/com_example/language/en-GB. In the latter case, you must not include the translation file in the <code><languages></code> tag. As long as you have placed the language directory in your <code><files></code> tag, it will be copied along when the component is being installed.

The contents of that file should be:
<source>
COM_EXAMPLE="Example Component"
</source>

Please note that the language string must be enclosed in double quotes, as per Joomla!'s translation standards.

NB: Joomla! 1.6 and later sorts the Component menu items based on the actual translation of the key you supply in your XML manifest. This means that the sorting order is correct no matter what you call your translation key and no matter which language the site is being displayed in. Essentially, Joomla! 1.6 fixed the wrong sorting of the Components menu for the majority (non-English speaking!) of Joomla! users.

===How to have a cross-version (Joomla! 1.5, 1.6 and later) component===

If your component is supposed to be installed under both Joomla! 1.5 and Joomla! 1.6/1.7/2.5, you can do a little trick. You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration></code> tag.
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>

Now, you need to create two files, one for Joomla! 1.5 and one for Joomla! 1.6. For Joomla! 1.5 you need to create a file named en-GB.com_example.menu.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation). Its contents should be:
<source>
COM_EXAMPLE=Example Component
</source>
For Joomla! 1.6 you need to create a file named en-GB.com_example.sys.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation) or in administrator/components/com_example/language/en-GB. In the latter case, you must not include the translation file in the <code><languages></code> tag. As long as you have placed the language directory in your <code><files></code> tag, it will be copied along when the component is being installed.

The contents of that file should be:
<source>
COM_EXAMPLE="Example Component"
</source>

The only drawback is that your component will appear as weirdly sorted in the Components menu of Joomla! 1.5. Given the very near expiration date of Joomla! 1.5 (April 2012) this is not a major drawback and experience shows that users don't really care that much.

===What if you do that and nothing happens?===

Joomla! is supposed to create the components menu entries afresh every time you re-install the component. If this doesn't happen in your case, try uninstalling and re-installing your component. If you're not sure if Joomla! has the correct Components menu item translation key, you can always check the menu items database table. This will prevent you from unnecessary frustration when your translation files don't work simply because Joomla! has the wrong translation key in the table.

== More tricks? ==

I am sure that by writing this page I have left out a number of tricks which I am already using in my software. If you get stuck somewhere, feel free to take a look at how I've implemented things in Admin Tools Core, Akeeba Backup Core and Akeeba Release System, my Joomla! 1.5/1.6/1.7 compatible extensions. If you find a better way to implement something, or found a trick not listed here, feel free to edit this wiki page. Sharing the knowledge is caring!

Peace, love and friendship,

Nicholas K. Dionysopoulos, AkeebaBackup.com Lead Developer

Making single installation packages for Joomla! 1.5 and 2.5 series

2011-11-21T11:03:16Z

Hidabe: /* Obsolte code */

{{review}}

It is possible to create a single installation package which can install a component in Joomla! 1.5, 1.6 and 1.7 with minor changes. Below you will find some of the most common tricks required to create an extension which is compatible with all current versions of the Joomla! CMS.

== Dealing with API changes ==
You will regularly bump into cases where an API has changed between Joomla! 1.5, 1.6 and 1.7. In order to cater for them, you need to run slightly different code based on the Joomla! version. Right now it's possible to do that by writing conditional statements like this:

<source lang="php">
if(version_compare(JVERSION,'1.7.0','ge')) {
// Joomla! 1.7 code here
} elseif(version_compare(JVERSION,'1.6.0','ge')) {
// Joomla! 1.6 code here
} else {
// Joomla! 1.5 code here
}
</source>

If you do not have Joomla! 1.7-specific code -i.e it is the same as the Joomla! 1.6-specific code- please use the following code:

<source lang="php">
if(version_compare(JVERSION,'1.6.0','ge')) {
// Joomla! 1.6 code here
} else {
// Joomla! 1.5 code here
}
</source>

While this conditional statement looks like an overkill, it has two major advantages:
* Compatibility with all Joomla! versions using the same package, therefore using the same codebase, ergo less maintenance overhead
* Once, let's say, Joomla! 1.8 is released and you decide to drop support for earlier Joomla! releases, we can just search your code for "if(version_compare(JVERSION," and remove all of the legacy code.

== One XML configuration file, multiple Joomla! versions ==

Various XML files in Joomla! accept settings, or parameters. For example your extension manifest file, the config.xml file and the view XML files all accept such settings. You may have noticed that whereas in Joomla! 1.5 these were found under the <params> tags, in Joomla! 1.6 and later they are found inside <filedsets>. One hidden secret of Joomla! is that Joomla! 1.5 will ignore Joomla! 1.6 syntax, whereas Joomla! 1.6/1.7 will ignore Joomla! 1.5 syntax. This allows you to have a single XML file which caters for all Joomla! releases. For example, here's a sample config.xml file, to be placed in the component's backend directory:

<source lang="xml">
<?xml version="1.0" encoding="utf-8"?>
<config>

<params>
<param name="foobar" type="text" default="" size="30"
label="COM_FOOBAR_OPTION_FOOBAR_LBL"
description ="COM_FOOBAR_OPTION_FOOBAR_DESC" />
</params>


<fieldset
name="basic"
label="COM_FOOBAR_OPTIONS_SECTION_BASIC_LBL"
description="COM_FOOBAR_OPTIONS_SECTION_BASIC_DESC"
>
<field name="foobar" type="text" default="" size="30"
label="COM_FOOBAR_OPTION_FOOBAR_LBL"
description ="COM_FOOBAR_OPTION_FOOBAR_DESC" />
</fieldset>
</config>
</source>

That's how easy it is!

== Dealing with languages ==

=== How to load component-local translation files in Joomla! 1.5 ===

Joomla! 1.6 introduced a new feature where a user can place language files inside the component's directory, e.g. administrator/com_foobar/language/en-GB/en-GB.com_foobar.ini, in order to provide language overrides. But Joomla! 1.5 doesn't support this feature. Or does it? Even though it can not do that automatically, you can do so in your extension's dispatcher file, e.g. administrator/com_foobar/foobar.php. Here's the magic code to do that in the backend:
<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, null, true);
$jlang->load('com_foobar', JPATH_COMPONENT_ADMINISTRATOR, null, true);
</source>
and the frontend:
<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_SITE, null, true);
$jlang->load('com_foobar', JPATH_COMPONENT, null, true);
</source>

=== Tips and tricks for language strings ===

All your translation keys should consist of uppercase characters without spaces (that is A-Z, 0-9 and underscores). All translation values should be included in double quotation marks. This allows the translation files to be parsed by Joomla! 1.5/1.6/1.7 alike. You are also suggested to prefix your translation keys with the extension's name, albeit this is not required. For example, this is a good translation string:
COM_FOOBAR_CPANEL_TITLE="Foobar Control Panel"
whereas this is a '''bad''' translation string:
CONTROL PANEL=Foobar Control Panel
The former works with all current versions of Joomla!, the latter doesn't.

If you have double quotation marks in your translation values, please replace them with single quotation marks. While Joomla! 1.5 allowed escaping the double quotation marks with \", Joomla! 1.6 under newer versions of PHP don't and require you to escape them as "__QQ__" which throws off Joomla! 1.5's parser. The workaround is to take advantage of a little known fact about HTML, that attributes can be wrapped in single quotation marks. For instance, change this:
COM_FOOBAR_SOME_KEY=<a href="http://www.example.com">Just a test</a>
to this:
COM_FOOBAR_SOME_KEY="<a href='http://www.example.com'>Just a test</a>"
It is valid HTML, it works on Joomla! 1.5/1.6/1.7 but it will invalidates XHTML. You can't always win, sorry.

=== Making untranslated strings look more beautiful ===

The problem with using tight translation keys as we described is that untranslated strings now look something like COM_FOOBAR_VIEWNAME_SOMEKEY. If you have volunteer translators you can bet your head that most translations will not be in sync with your component and you will have untranslated strings. In Joomla! 1.5, using "natural language" keys, you got to show your users the default (English) text if a translation key didn't exist in their language. This is impossible in Joomla! 1.6... or maybe not?

We can use the same little trick in our component's dispatcher as with our component-local translation loading string above. Here's how to load the English translation file in the backend of your component, then overwrite only the keys which exist with the user's selected language, essentially allowing untranslated keys to show in English:

<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, 'en-GB', true);
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, null, true);
</source>

The same thing in the front-end:

<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_SITE, 'en-GB', true);
$jlang->load('com_foobar', JPATH_SITE, null, true);
</source>

== JElement vs JFormField ==

Oh, the struggle! You need a custom widget in the configuration section of your component. In Joomla! 1.5 you could just create a new JElement. In Joomla! 1.6 you could just create a new JFormField. But both? In a single file? You can employ a simple trick. In the following example I am going to create a rather lame element, called SQL2, which displays a multi-selection box out of the results of a SQL statement. This is made as part of a fictitious module called mod_foobar

First, let your configuration know where to load the custom widget files from, by putting this in your module's XML manifest file:

<source lang="xml">
<params addpath="/modules/mod_foobar/elements">
<param name="ids" type="sql2" default=""
label="MOD_FOOBAR_LEVELS_TITLE"
description="MOD_FOOBAR_LEVELS_DESC"
query="SELECT `foobar_level_id`, `title` FROM `#__foobar_levels`"
key_field="foobar_level_id"
value_field="title" />
</params>

<config addfieldpath="/modules/mod_foobar/elements">
<fields name="params">
<fieldset name="basic">
<field name="ids" type="sql2" default=""
label="MOD_FOOBAR_LEVELS_TITLE"
description="MOD_FOOBAR_LEVELS_DESC"
query="SELECT `foobar_level_id`, `title` FROM `#__foobar_levels`"
key_field="foobar_level_id"
value_field="title" />
</fieldset>
</fields>
</config>
</source>

As you see, we instruct both Joomla! 1.5 and 1.6/1.7 to look into the same directory, for the same-named file (sql2.php). Here are the contents of the modules/mod_foobar/elements/sql2.php file:

<source lang="php">
defined('_JEXEC') or die('Restricted Access');

/*
* This trick allows us to extend the correct class, based on whether it's Joomla! 1.5 or 1.6
*/
if(!class_exists('JFakeElementBase')) {
if(version_compare(JVERSION,'1.6.0','ge')) {
class JFakeElementBase extends JFormField {
// This line is required to keep Joomla! 1.6/1.7 from complaining
public function getInput() {}
}
} else {
class JFakeElementBase extends JElement {}
}
}

/**
* Our main element class, creating a multi-select list out of an SQL statement
*/
class JFakeElementSQL2 extends JFakeElementBase
{
var $_name = 'SQL2';

// Joomla! 1.5
function fetchElement($name, $value, &$node, $control_name)
{
$db = & JFactory::getDBO();
$db->setQuery($node->attributes('query'));
$key = ($node->attributes('key_field') ? $node->attributes('key_field') : 'value');
$val = ($node->attributes('value_field') ? $node->attributes('value_field') : $name);
return JHTML::_('select.genericlist', $db->loadObjectList(), ''.$control_name.'['.$name.'][]', 'class="inputbox" multiple="multiple" size="5"', $key, $val, $value, $control_name.$name);
}

// Joomla! 1.6
function getInput()
{
$db = & JFactory::getDBO();
$db->setQuery($this->element['query']);
$key = ($this->element['key_field'] ? $this->element['key_field'] : 'value');
$val = ($this->element['value_field'] ? $this->element['value_field'] : $this->name);
return JHTML::_('select.genericlist', $db->loadObjectList(), $this->name, 'class="inputbox" multiple="multiple" size="5"', $key, $val, $this->value, $this->id);
}
}

/*
* Part two of our trick; we define the proper element name, depending on whether it's Joomla! 1.5 or 1.6
*/
if(version_compare(JVERSION,'1.6.0','ge')) {
class JFormFieldSQL2 extends JFakeElementSQL2 {}
} else {
class JElementSQL2 extends JFakeElementSQL2 {}
}
</source>

Considering that most custom widgets have a lot more code than this, you can create two different initialisation sections for Joomla! 1.5 and 1.6/1.7 (fetchElement and getInput), populate class variables, then call a big, common method to render the bulk of the widget (just like we did with JHTML's genericlist in the example above). This will eliminate the need to rewrite the same code over again just to cater for a new Joomla! version.

== Obsolte code ==

Joomla 1.6 / 1.7 have been left any code obsolete, we should review code for do compatible with all versions.
=== Global Mainframe ===
Bad: <source>global $mainframe;</source>
Good: <source>$mainframe = &JFactory::getApplication();</source>

=== Global Options ===
Bad: <source>global $options;</source>
Good: <source>$option = JRequest::getCmd('option');</source>

I will add more changes like it.

== Content plugins work slightly different ==

The content plugins in Joomla! 1.5 were using the onPrepareContent method, whereas the content plugins in Joomla! 1.6/1.7 use the onContentPrepare method. The arguments have also changed. You can, however, create a single content plugin which runs on both Joomla! versions without rewriting code. Here's how:

<source lang="php">
defined('_JEXEC') or die();

jimport('joomla.plugin.plugin');

class plgContentFoobar extends JPlugin
{
public function onPrepareContent( &$article, &$params, $limitstart = 0 )
{
$article->text = $this->doSomethingWith($article->text);
}

public function onContentPrepare($context, &$row, &$params, $page = 0)
{
// Danger, Will Robinson! $row in Joomla! 1.6/1.7 may be a string, not an article object!
if(is_object($row)) {
return $this->onPrepareContent($row, $params, $page);
} else {
$row = $this->doSomethingWith($row);
}

return true;
}

private function doSomethingWith($text)
{
// Apparently, you have to do something here ;)
return $text;
}
}
</source>

== Updating doesn't work as you'd expect ==

There is a small but very disturbing bug in Joomla! 1.6. Updating a component whose manifest XML states version="1.5.0" doesn't allow you to run the SQL statements. Namely, the SQL files you specify under the "<install><sql>" tags won't run. You can neither use the new "<update>" tag. You are stuck with no way to run SQL commands on component update!

The ugly workaround is to create a file named script.foobar.php with the following contents:

<source lang="php">
<?php
define('_JEXEC') or die();

class Com_FoobarInstallerScript {

function update($parent) {
$db = JFactory::getDBO();
// Obviously you may have to change the path and name if your installation SQL file ;)
if(method_exists($parent, 'extension_root')) {
$sqlfile = $parent->getPath('extension_root').DS.'install.sql';
} else {
$sqlfile = $parent->getParent()->getPath('extension_root').DS.'install.sql';
}
// Don't modify below this line
$buffer = file_get_contents($sqlfile);
if ($buffer !== false) {
jimport('joomla.installer.helper');
$queries = JInstallerHelper::splitSql($buffer);
if (count($queries) != 0) {
foreach ($queries as $query)
{
$query = trim($query);
if ($query != '' && $query{0} != '#') {
$db->setQuery($query);
if (!$db->query()) {
JError::raiseWarning(1, JText::sprintf('JLIB_INSTALLER_ERROR_SQL_ERROR', $db->stderr(true)));
return false;
}
}
}
}
}
}
</source>

Reference that file in the end of your manifest XML file, just above the closing install tag, with:
<source type="xml">
<scriptfile>script.foobar.php</scriptfile>
</source>

This will force Joomla! 1.6 to run your extension's installation SQL file during the component update, just like Joomla! 1.5 used to do. Enjoy!

== Menu item creation tricks ==

===For Joomla! 1.5===

You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration><code> tag.

<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>
or
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">Example Component</menu>
</source>

In both cases, you need to create a file named en-GB.com_example.menu.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation). In the first case (using a translation key), its contents should be:
<source>
COM_EXAMPLE=Example Component
</source>
In the second case (using natural language strings) its contents should be
<source>
Example Component=Example Component
</source>

NB: Joomla! 1.5 sorts the Component menu items based on the key you supply in your XML manifest. If you use the COM_EXAMPLE approach, your component will be sorted with all the components beginning with "C", e.g. just before Contacts on a fresh Joomla! 1.5 installation, no matter what the translation is! This leads to funny results, especially with non-English languages where the translated component names do not follow the same sorting order as their English names. If you are bilingual or multilingual, I think you know what I mean…

===For Joomla! 1.6 and later versions===

You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration></code> tag.
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>

You can not use a natural language string. Doing so will result in your component name appearing as example-component in the menu and you will be unable to provide a translation.

You need to create a file named en-GB.com_example.sys.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation) or in administrator/components/com_example/language/en-GB. In the latter case, you must not include the translation file in the <code><languages></code> tag. As long as you have placed the language directory in your <code><files></code> tag, it will be copied along when the component is being installed.

The contents of that file should be:
<source>
COM_EXAMPLE="Example Component"
</source>

Please note that the language string must be enclosed in double quotes, as per Joomla!'s translation standards.

NB: Joomla! 1.6 and later sorts the Component menu items based on the actual translation of the key you supply in your XML manifest. This means that the sorting order is correct no matter what you call your translation key and no matter which language the site is being displayed in. Essentially, Joomla! 1.6 fixed the wrong sorting of the Components menu for the majority (non-English speaking!) of Joomla! users.

===How to have a cross-version (Joomla! 1.5, 1.6 and later) component===

If your component is supposed to be installed under both Joomla! 1.5 and Joomla! 1.6/1.7/2.5, you can do a little trick. You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration></code> tag.
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>

Now, you need to create two files, one for Joomla! 1.5 and one for Joomla! 1.6. For Joomla! 1.5 you need to create a file named en-GB.com_example.menu.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation). Its contents should be:
<source>
COM_EXAMPLE=Example Component
</source>
For Joomla! 1.6 you need to create a file named en-GB.com_example.sys.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation) or in administrator/components/com_example/language/en-GB. In the latter case, you must not include the translation file in the <code><languages></code> tag. As long as you have placed the language directory in your <code><files></code> tag, it will be copied along when the component is being installed.

The contents of that file should be:
<source>
COM_EXAMPLE="Example Component"
</source>

The only drawback is that your component will appear as weirdly sorted in the Components menu of Joomla! 1.5. Given the very near expiration date of Joomla! 1.5 (April 2012) this is not a major drawback and experience shows that users don't really care that much.

===What if you do that and nothing happens?===

Joomla! is supposed to create the components menu entries afresh every time you re-install the component. If this doesn't happen in your case, try uninstalling and re-installing your component. If you're not sure if Joomla! has the correct Components menu item translation key, you can always check the menu items database table. This will prevent you from unnecessary frustration when your translation files don't work simply because Joomla! has the wrong translation key in the table.

== More tricks? ==

I am sure that by writing this page I have left out a number of tricks which I am already using in my software. If you get stuck somewhere, feel free to take a look at how I've implemented things in Admin Tools Core, Akeeba Backup Core and Akeeba Release System, my Joomla! 1.5/1.6/1.7 compatible extensions. If you find a better way to implement something, or found a trick not listed here, feel free to edit this wiki page. Sharing the knowledge is caring!

Peace, love and friendship,

Nicholas K. Dionysopoulos, AkeebaBackup.com Lead Developer

Making single installation packages for Joomla! 1.5 and 2.5 series

2011-11-14T09:48:54Z

Hidabe: /* Global Mainframe */

{{review}}

It is possible to create a single installation package which can install a component in Joomla! 1.5, 1.6 and 1.7 with minor changes. Below you will find some of the most common tricks required to create an extension which is compatible with all current versions of the Joomla! CMS.

== Dealing with API changes ==
You will regularly bump into cases where an API has changed between Joomla! 1.5, 1.6 and 1.7. In order to cater for them, you need to run slightly different code based on the Joomla! version. Right now it's possible to do that by writing conditional statements like this:

<source lang="php">
if(version_compare(JVERSION,'1.7.0','ge')) {
// Joomla! 1.7 code here
} elseif(version_compare(JVERSION,'1.6.0','ge')) {
// Joomla! 1.6 code here
} else {
// Joomla! 1.5 code here
}
</source>

If you do not have Joomla! 1.7-specific code -i.e it is the same as the Joomla! 1.6-specific code- please use the following code:

<source lang="php">
if(version_compare(JVERSION,'1.6.0','ge')) {
// Joomla! 1.6 code here
} else {
// Joomla! 1.5 code here
}
</source>

While this conditional statement looks like an overkill, it has two major advantages:
* Compatibility with all Joomla! versions using the same package, therefore using the same codebase, ergo less maintenance overhead
* Once, let's say, Joomla! 1.8 is released and you decide to drop support for earlier Joomla! releases, we can just search your code for "if(version_compare(JVERSION," and remove all of the legacy code.

== One XML configuration file, multiple Joomla! versions ==

Various XML files in Joomla! accept settings, or parameters. For example your extension manifest file, the config.xml file and the view XML files all accept such settings. You may have noticed that whereas in Joomla! 1.5 these were found under the <params> tags, in Joomla! 1.6 and later they are found inside <filedsets>. One hidden secret of Joomla! is that Joomla! 1.5 will ignore Joomla! 1.6 syntax, whereas Joomla! 1.6/1.7 will ignore Joomla! 1.5 syntax. This allows you to have a single XML file which caters for all Joomla! releases. For example, here's a sample config.xml file, to be placed in the component's backend directory:

<source lang="xml">
<?xml version="1.0" encoding="utf-8"?>
<config>

<params>
<param name="foobar" type="text" default="" size="30"
label="COM_FOOBAR_OPTION_FOOBAR_LBL"
description ="COM_FOOBAR_OPTION_FOOBAR_DESC" />
</params>


<fieldset
name="basic"
label="COM_FOOBAR_OPTIONS_SECTION_BASIC_LBL"
description="COM_FOOBAR_OPTIONS_SECTION_BASIC_DESC"
>
<field name="foobar" type="text" default="" size="30"
label="COM_FOOBAR_OPTION_FOOBAR_LBL"
description ="COM_FOOBAR_OPTION_FOOBAR_DESC" />
</fieldset>
</config>
</source>

That's how easy it is!

== Dealing with languages ==

=== How to load component-local translation files in Joomla! 1.5 ===

Joomla! 1.6 introduced a new feature where a user can place language files inside the component's directory, e.g. administrator/com_foobar/language/en-GB/en-GB.com_foobar.ini, in order to provide language overrides. But Joomla! 1.5 doesn't support this feature. Or does it? Even though it can not do that automatically, you can do so in your extension's dispatcher file, e.g. administrator/com_foobar/foobar.php. Here's the magic code to do that in the backend:
<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, null, true);
$jlang->load('com_foobar', JPATH_COMPONENT_ADMINISTRATOR, null, true);
</source>
and the frontend:
<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_SITE, null, true);
$jlang->load('com_foobar', JPATH_COMPONENT, null, true);
</source>

=== Tips and tricks for language strings ===

All your translation keys should consist of uppercase characters without spaces (that is A-Z, 0-9 and underscores). All translation values should be included in double quotation marks. This allows the translation files to be parsed by Joomla! 1.5/1.6/1.7 alike. You are also suggested to prefix your translation keys with the extension's name, albeit this is not required. For example, this is a good translation string:
COM_FOOBAR_CPANEL_TITLE="Foobar Control Panel"
whereas this is a '''bad''' translation string:
CONTROL PANEL=Foobar Control Panel
The former works with all current versions of Joomla!, the latter doesn't.

If you have double quotation marks in your translation values, please replace them with single quotation marks. While Joomla! 1.5 allowed escaping the double quotation marks with \", Joomla! 1.6 under newer versions of PHP don't and require you to escape them as "__QQ__" which throws off Joomla! 1.5's parser. The workaround is to take advantage of a little known fact about HTML, that attributes can be wrapped in single quotation marks. For instance, change this:
COM_FOOBAR_SOME_KEY=<a href="http://www.example.com">Just a test</a>
to this:
COM_FOOBAR_SOME_KEY="<a href='http://www.example.com'>Just a test</a>"
It is valid HTML, it works on Joomla! 1.5/1.6/1.7 but it will invalidates XHTML. You can't always win, sorry.

=== Making untranslated strings look more beautiful ===

The problem with using tight translation keys as we described is that untranslated strings now look something like COM_FOOBAR_VIEWNAME_SOMEKEY. If you have volunteer translators you can bet your head that most translations will not be in sync with your component and you will have untranslated strings. In Joomla! 1.5, using "natural language" keys, you got to show your users the default (English) text if a translation key didn't exist in their language. This is impossible in Joomla! 1.6... or maybe not?

We can use the same little trick in our component's dispatcher as with our component-local translation loading string above. Here's how to load the English translation file in the backend of your component, then overwrite only the keys which exist with the user's selected language, essentially allowing untranslated keys to show in English:

<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, 'en-GB', true);
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, null, true);
</source>

The same thing in the front-end:

<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_SITE, 'en-GB', true);
$jlang->load('com_foobar', JPATH_SITE, null, true);
</source>

== JElement vs JFormField ==

Oh, the struggle! You need a custom widget in the configuration section of your component. In Joomla! 1.5 you could just create a new JElement. In Joomla! 1.6 you could just create a new JFormField. But both? In a single file? You can employ a simple trick. In the following example I am going to create a rather lame element, called SQL2, which displays a multi-selection box out of the results of a SQL statement. This is made as part of a fictitious module called mod_foobar

First, let your configuration know where to load the custom widget files from, by putting this in your module's XML manifest file:

<source lang="xml">
<params addpath="/modules/mod_foobar/elements">
<param name="ids" type="sql2" default=""
label="MOD_FOOBAR_LEVELS_TITLE"
description="MOD_FOOBAR_LEVELS_DESC"
query="SELECT `foobar_level_id`, `title` FROM `#__foobar_levels`"
key_field="foobar_level_id"
value_field="title" />
</params>

<config addfieldpath="/modules/mod_foobar/elements">
<fields name="params">
<fieldset name="basic">
<field name="ids" type="sql2" default=""
label="MOD_FOOBAR_LEVELS_TITLE"
description="MOD_FOOBAR_LEVELS_DESC"
query="SELECT `foobar_level_id`, `title` FROM `#__foobar_levels`"
key_field="foobar_level_id"
value_field="title" />
</fieldset>
</fields>
</config>
</source>

As you see, we instruct both Joomla! 1.5 and 1.6/1.7 to look into the same directory, for the same-named file (sql2.php). Here are the contents of the modules/mod_foobar/elements/sql2.php file:

<source lang="php">
defined('_JEXEC') or die('Restricted Access');

/*
* This trick allows us to extend the correct class, based on whether it's Joomla! 1.5 or 1.6
*/
if(!class_exists('JFakeElementBase')) {
if(version_compare(JVERSION,'1.6.0','ge')) {
class JFakeElementBase extends JFormField {
// This line is required to keep Joomla! 1.6/1.7 from complaining
public function getInput() {}
}
} else {
class JFakeElementBase extends JElement {}
}
}

/**
* Our main element class, creating a multi-select list out of an SQL statement
*/
class JFakeElementSQL2 extends JFakeElementBase
{
var $_name = 'SQL2';

// Joomla! 1.5
function fetchElement($name, $value, &$node, $control_name)
{
$db = & JFactory::getDBO();
$db->setQuery($node->attributes('query'));
$key = ($node->attributes('key_field') ? $node->attributes('key_field') : 'value');
$val = ($node->attributes('value_field') ? $node->attributes('value_field') : $name);
return JHTML::_('select.genericlist', $db->loadObjectList(), ''.$control_name.'['.$name.'][]', 'class="inputbox" multiple="multiple" size="5"', $key, $val, $value, $control_name.$name);
}

// Joomla! 1.6
function getInput()
{
$db = & JFactory::getDBO();
$db->setQuery($this->element['query']);
$key = ($this->element['key_field'] ? $this->element['key_field'] : 'value');
$val = ($this->element['value_field'] ? $this->element['value_field'] : $this->name);
return JHTML::_('select.genericlist', $db->loadObjectList(), $this->name, 'class="inputbox" multiple="multiple" size="5"', $key, $val, $this->value, $this->id);
}
}

/*
* Part two of our trick; we define the proper element name, depending on whether it's Joomla! 1.5 or 1.6
*/
if(version_compare(JVERSION,'1.6.0','ge')) {
class JFormFieldSQL2 extends JFakeElementSQL2 {}
} else {
class JElementSQL2 extends JFakeElementSQL2 {}
}
</source>

Considering that most custom widgets have a lot more code than this, you can create two different initialisation sections for Joomla! 1.5 and 1.6/1.7 (fetchElement and getInput), populate class variables, then call a big, common method to render the bulk of the widget (just like we did with JHTML's genericlist in the example above). This will eliminate the need to rewrite the same code over again just to cater for a new Joomla! version.

== Obsolte code ==

Joomla 1.6 / 1.7 have been left any code obsolete, we should review code for do compatible with all versions.
=== Global Mainframe ===
Bad: <source>global $mainframe;</source>
Good: <source>$mainframe = &JFactory::getApplication();</source>

I will add more changes like it.

== Content plugins work slightly different ==

The content plugins in Joomla! 1.5 were using the onPrepareContent method, whereas the content plugins in Joomla! 1.6/1.7 use the onContentPrepare method. The arguments have also changed. You can, however, create a single content plugin which runs on both Joomla! versions without rewriting code. Here's how:

<source lang="php">
defined('_JEXEC') or die();

jimport('joomla.plugin.plugin');

class plgContentFoobar extends JPlugin
{
public function onPrepareContent( &$article, &$params, $limitstart = 0 )
{
$article->text = $this->doSomethingWith($article->text);
}

public function onContentPrepare($context, &$row, &$params, $page = 0)
{
// Danger, Will Robinson! $row in Joomla! 1.6/1.7 may be a string, not an article object!
if(is_object($row)) {
return $this->onPrepareContent($row, $params, $page);
} else {
$row = $this->doSomethingWith($row);
}

return true;
}

private function doSomethingWith($text)
{
// Apparently, you have to do something here ;)
return $text;
}
}
</source>

== Updating doesn't work as you'd expect ==

There is a small but very disturbing bug in Joomla! 1.6. Updating a component whose manifest XML states version="1.5.0" doesn't allow you to run the SQL statements. Namely, the SQL files you specify under the "<install><sql>" tags won't run. You can neither use the new "<update>" tag. You are stuck with no way to run SQL commands on component update!

The ugly workaround is to create a file named script.foobar.php with the following contents:

<source lang="php">
<?php
define('_JEXEC') or die();

class Com_FoobarInstallerScript {

function update($parent) {
$db = JFactory::getDBO();
// Obviously you may have to change the path and name if your installation SQL file ;)
if(method_exists($parent, 'extension_root')) {
$sqlfile = $parent->getPath('extension_root').DS.'install.sql';
} else {
$sqlfile = $parent->getParent()->getPath('extension_root').DS.'install.sql';
}
// Don't modify below this line
$buffer = file_get_contents($sqlfile);
if ($buffer !== false) {
jimport('joomla.installer.helper');
$queries = JInstallerHelper::splitSql($buffer);
if (count($queries) != 0) {
foreach ($queries as $query)
{
$query = trim($query);
if ($query != '' && $query{0} != '#') {
$db->setQuery($query);
if (!$db->query()) {
JError::raiseWarning(1, JText::sprintf('JLIB_INSTALLER_ERROR_SQL_ERROR', $db->stderr(true)));
return false;
}
}
}
}
}
}
</source>

Reference that file in the end of your manifest XML file, just above the closing install tag, with:
<source type="xml">
<scriptfile>script.foobar.php</scriptfile>
</source>

This will force Joomla! 1.6 to run your extension's installation SQL file during the component update, just like Joomla! 1.5 used to do. Enjoy!

== Menu item creation tricks ==

===For Joomla! 1.5===

You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration><code> tag.

<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>
or
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">Example Component</menu>
</source>

In both cases, you need to create a file named en-GB.com_example.menu.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation). In the first case (using a translation key), its contents should be:
<source>
COM_EXAMPLE=Example Component
</source>
In the second case (using natural language strings) its contents should be
<source>
Example Component=Example Component
</source>

NB: Joomla! 1.5 sorts the Component menu items based on the key you supply in your XML manifest. If you use the COM_EXAMPLE approach, your component will be sorted with all the components beginning with "C", e.g. just before Contacts on a fresh Joomla! 1.5 installation, no matter what the translation is! This leads to funny results, especially with non-English languages where the translated component names do not follow the same sorting order as their English names. If you are bilingual or multilingual, I think you know what I mean…

===For Joomla! 1.6 and later versions===

You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration></code> tag.
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>

You can not use a natural language string. Doing so will result in your component name appearing as example-component in the menu and you will be unable to provide a translation.

You need to create a file named en-GB.com_example.sys.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation) or in administrator/components/com_example/language/en-GB. In the latter case, you must not include the translation file in the <code><languages></code> tag. As long as you have placed the language directory in your <code><files></code> tag, it will be copied along when the component is being installed.

The contents of that file should be:
<source>
COM_EXAMPLE="Example Component"
</source>

Please note that the language string must be enclosed in double quotes, as per Joomla!'s translation standards.

NB: Joomla! 1.6 and later sorts the Component menu items based on the actual translation of the key you supply in your XML manifest. This means that the sorting order is correct no matter what you call your translation key and no matter which language the site is being displayed in. Essentially, Joomla! 1.6 fixed the wrong sorting of the Components menu for the majority (non-English speaking!) of Joomla! users.

===How to have a cross-version (Joomla! 1.5, 1.6 and later) component===

If your component is supposed to be installed under both Joomla! 1.5 and Joomla! 1.6/1.7/2.5, you can do a little trick. You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration></code> tag.
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>

Now, you need to create two files, one for Joomla! 1.5 and one for Joomla! 1.6. For Joomla! 1.5 you need to create a file named en-GB.com_example.menu.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation). Its contents should be:
<source>
COM_EXAMPLE=Example Component
</source>
For Joomla! 1.6 you need to create a file named en-GB.com_example.sys.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation) or in administrator/components/com_example/language/en-GB. In the latter case, you must not include the translation file in the <code><languages></code> tag. As long as you have placed the language directory in your <code><files></code> tag, it will be copied along when the component is being installed.

The contents of that file should be:
<source>
COM_EXAMPLE="Example Component"
</source>

The only drawback is that your component will appear as weirdly sorted in the Components menu of Joomla! 1.5. Given the very near expiration date of Joomla! 1.5 (April 2012) this is not a major drawback and experience shows that users don't really care that much.

===What if you do that and nothing happens?===

Joomla! is supposed to create the components menu entries afresh every time you re-install the component. If this doesn't happen in your case, try uninstalling and re-installing your component. If you're not sure if Joomla! has the correct Components menu item translation key, you can always check the menu items database table. This will prevent you from unnecessary frustration when your translation files don't work simply because Joomla! has the wrong translation key in the table.

== More tricks? ==

I am sure that by writing this page I have left out a number of tricks which I am already using in my software. If you get stuck somewhere, feel free to take a look at how I've implemented things in Admin Tools Core, Akeeba Backup Core and Akeeba Release System, my Joomla! 1.5/1.6/1.7 compatible extensions. If you find a better way to implement something, or found a trick not listed here, feel free to edit this wiki page. Sharing the knowledge is caring!

Peace, love and friendship,

Nicholas K. Dionysopoulos, AkeebaBackup.com Lead Developer

Making single installation packages for Joomla! 1.5 and 2.5 series

2011-11-14T08:23:16Z

Hidabe:

{{review}}

It is possible to create a single installation package which can install a component in Joomla! 1.5, 1.6 and 1.7 with minor changes. Below you will find some of the most common tricks required to create an extension which is compatible with all current versions of the Joomla! CMS.

== Dealing with API changes ==
You will regularly bump into cases where an API has changed between Joomla! 1.5, 1.6 and 1.7. In order to cater for them, you need to run slightly different code based on the Joomla! version. Right now it's possible to do that by writing conditional statements like this:

<source lang="php">
if(version_compare(JVERSION,'1.7.0','ge')) {
// Joomla! 1.7 code here
} elseif(version_compare(JVERSION,'1.6.0','ge')) {
// Joomla! 1.6 code here
} else {
// Joomla! 1.5 code here
}
</source>

If you do not have Joomla! 1.7-specific code -i.e it is the same as the Joomla! 1.6-specific code- please use the following code:

<source lang="php">
if(version_compare(JVERSION,'1.6.0','ge')) {
// Joomla! 1.6 code here
} else {
// Joomla! 1.5 code here
}
</source>

While this conditional statement looks like an overkill, it has two major advantages:
* Compatibility with all Joomla! versions using the same package, therefore using the same codebase, ergo less maintenance overhead
* Once, let's say, Joomla! 1.8 is released and you decide to drop support for earlier Joomla! releases, we can just search your code for "if(version_compare(JVERSION," and remove all of the legacy code.

== One XML configuration file, multiple Joomla! versions ==

Various XML files in Joomla! accept settings, or parameters. For example your extension manifest file, the config.xml file and the view XML files all accept such settings. You may have noticed that whereas in Joomla! 1.5 these were found under the <params> tags, in Joomla! 1.6 and later they are found inside <filedsets>. One hidden secret of Joomla! is that Joomla! 1.5 will ignore Joomla! 1.6 syntax, whereas Joomla! 1.6/1.7 will ignore Joomla! 1.5 syntax. This allows you to have a single XML file which caters for all Joomla! releases. For example, here's a sample config.xml file, to be placed in the component's backend directory:

<source lang="xml">
<?xml version="1.0" encoding="utf-8"?>
<config>

<params>
<param name="foobar" type="text" default="" size="30"
label="COM_FOOBAR_OPTION_FOOBAR_LBL"
description ="COM_FOOBAR_OPTION_FOOBAR_DESC" />
</params>


<fieldset
name="basic"
label="COM_FOOBAR_OPTIONS_SECTION_BASIC_LBL"
description="COM_FOOBAR_OPTIONS_SECTION_BASIC_DESC"
>
<field name="foobar" type="text" default="" size="30"
label="COM_FOOBAR_OPTION_FOOBAR_LBL"
description ="COM_FOOBAR_OPTION_FOOBAR_DESC" />
</fieldset>
</config>
</source>

That's how easy it is!

== Dealing with languages ==

=== How to load component-local translation files in Joomla! 1.5 ===

Joomla! 1.6 introduced a new feature where a user can place language files inside the component's directory, e.g. administrator/com_foobar/language/en-GB/en-GB.com_foobar.ini, in order to provide language overrides. But Joomla! 1.5 doesn't support this feature. Or does it? Even though it can not do that automatically, you can do so in your extension's dispatcher file, e.g. administrator/com_foobar/foobar.php. Here's the magic code to do that in the backend:
<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, null, true);
$jlang->load('com_foobar', JPATH_COMPONENT_ADMINISTRATOR, null, true);
</source>
and the frontend:
<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_SITE, null, true);
$jlang->load('com_foobar', JPATH_COMPONENT, null, true);
</source>

=== Tips and tricks for language strings ===

All your translation keys should consist of uppercase characters without spaces (that is A-Z, 0-9 and underscores). All translation values should be included in double quotation marks. This allows the translation files to be parsed by Joomla! 1.5/1.6/1.7 alike. You are also suggested to prefix your translation keys with the extension's name, albeit this is not required. For example, this is a good translation string:
COM_FOOBAR_CPANEL_TITLE="Foobar Control Panel"
whereas this is a '''bad''' translation string:
CONTROL PANEL=Foobar Control Panel
The former works with all current versions of Joomla!, the latter doesn't.

If you have double quotation marks in your translation values, please replace them with single quotation marks. While Joomla! 1.5 allowed escaping the double quotation marks with \", Joomla! 1.6 under newer versions of PHP don't and require you to escape them as "__QQ__" which throws off Joomla! 1.5's parser. The workaround is to take advantage of a little known fact about HTML, that attributes can be wrapped in single quotation marks. For instance, change this:
COM_FOOBAR_SOME_KEY=<a href="http://www.example.com">Just a test</a>
to this:
COM_FOOBAR_SOME_KEY="<a href='http://www.example.com'>Just a test</a>"
It is valid HTML, it works on Joomla! 1.5/1.6/1.7 but it will invalidates XHTML. You can't always win, sorry.

=== Making untranslated strings look more beautiful ===

The problem with using tight translation keys as we described is that untranslated strings now look something like COM_FOOBAR_VIEWNAME_SOMEKEY. If you have volunteer translators you can bet your head that most translations will not be in sync with your component and you will have untranslated strings. In Joomla! 1.5, using "natural language" keys, you got to show your users the default (English) text if a translation key didn't exist in their language. This is impossible in Joomla! 1.6... or maybe not?

We can use the same little trick in our component's dispatcher as with our component-local translation loading string above. Here's how to load the English translation file in the backend of your component, then overwrite only the keys which exist with the user's selected language, essentially allowing untranslated keys to show in English:

<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, 'en-GB', true);
$jlang->load('com_foobar', JPATH_ADMINISTRATOR, null, true);
</source>

The same thing in the front-end:

<source lang="php">
$jlang =& JFactory::getLanguage();
$jlang->load('com_foobar', JPATH_SITE, 'en-GB', true);
$jlang->load('com_foobar', JPATH_SITE, null, true);
</source>

== JElement vs JFormField ==

Oh, the struggle! You need a custom widget in the configuration section of your component. In Joomla! 1.5 you could just create a new JElement. In Joomla! 1.6 you could just create a new JFormField. But both? In a single file? You can employ a simple trick. In the following example I am going to create a rather lame element, called SQL2, which displays a multi-selection box out of the results of a SQL statement. This is made as part of a fictitious module called mod_foobar

First, let your configuration know where to load the custom widget files from, by putting this in your module's XML manifest file:

<source lang="xml">
<params addpath="/modules/mod_foobar/elements">
<param name="ids" type="sql2" default=""
label="MOD_FOOBAR_LEVELS_TITLE"
description="MOD_FOOBAR_LEVELS_DESC"
query="SELECT `foobar_level_id`, `title` FROM `#__foobar_levels`"
key_field="foobar_level_id"
value_field="title" />
</params>

<config addfieldpath="/modules/mod_foobar/elements">
<fields name="params">
<fieldset name="basic">
<field name="ids" type="sql2" default=""
label="MOD_FOOBAR_LEVELS_TITLE"
description="MOD_FOOBAR_LEVELS_DESC"
query="SELECT `foobar_level_id`, `title` FROM `#__foobar_levels`"
key_field="foobar_level_id"
value_field="title" />
</fieldset>
</fields>
</config>
</source>

As you see, we instruct both Joomla! 1.5 and 1.6/1.7 to look into the same directory, for the same-named file (sql2.php). Here are the contents of the modules/mod_foobar/elements/sql2.php file:

<source lang="php">
defined('_JEXEC') or die('Restricted Access');

/*
* This trick allows us to extend the correct class, based on whether it's Joomla! 1.5 or 1.6
*/
if(!class_exists('JFakeElementBase')) {
if(version_compare(JVERSION,'1.6.0','ge')) {
class JFakeElementBase extends JFormField {
// This line is required to keep Joomla! 1.6/1.7 from complaining
public function getInput() {}
}
} else {
class JFakeElementBase extends JElement {}
}
}

/**
* Our main element class, creating a multi-select list out of an SQL statement
*/
class JFakeElementSQL2 extends JFakeElementBase
{
var $_name = 'SQL2';

// Joomla! 1.5
function fetchElement($name, $value, &$node, $control_name)
{
$db = & JFactory::getDBO();
$db->setQuery($node->attributes('query'));
$key = ($node->attributes('key_field') ? $node->attributes('key_field') : 'value');
$val = ($node->attributes('value_field') ? $node->attributes('value_field') : $name);
return JHTML::_('select.genericlist', $db->loadObjectList(), ''.$control_name.'['.$name.'][]', 'class="inputbox" multiple="multiple" size="5"', $key, $val, $value, $control_name.$name);
}

// Joomla! 1.6
function getInput()
{
$db = & JFactory::getDBO();
$db->setQuery($this->element['query']);
$key = ($this->element['key_field'] ? $this->element['key_field'] : 'value');
$val = ($this->element['value_field'] ? $this->element['value_field'] : $this->name);
return JHTML::_('select.genericlist', $db->loadObjectList(), $this->name, 'class="inputbox" multiple="multiple" size="5"', $key, $val, $this->value, $this->id);
}
}

/*
* Part two of our trick; we define the proper element name, depending on whether it's Joomla! 1.5 or 1.6
*/
if(version_compare(JVERSION,'1.6.0','ge')) {
class JFormFieldSQL2 extends JFakeElementSQL2 {}
} else {
class JElementSQL2 extends JFakeElementSQL2 {}
}
</source>

Considering that most custom widgets have a lot more code than this, you can create two different initialisation sections for Joomla! 1.5 and 1.6/1.7 (fetchElement and getInput), populate class variables, then call a big, common method to render the bulk of the widget (just like we did with JHTML's genericlist in the example above). This will eliminate the need to rewrite the same code over again just to cater for a new Joomla! version.

== Obsolte code ==

Joomla 1.6 / 1.7 have been left any code obsolete, we should review code for do compatible with all versions.
=== Global Mainframe ===
Bad: <source>global $mainframe</source>
Good: <source>$mainframe = &JFactory::getApplication();</source>

I will add more changes like it.

== Content plugins work slightly different ==

The content plugins in Joomla! 1.5 were using the onPrepareContent method, whereas the content plugins in Joomla! 1.6/1.7 use the onContentPrepare method. The arguments have also changed. You can, however, create a single content plugin which runs on both Joomla! versions without rewriting code. Here's how:

<source lang="php">
defined('_JEXEC') or die();

jimport('joomla.plugin.plugin');

class plgContentFoobar extends JPlugin
{
public function onPrepareContent( &$article, &$params, $limitstart = 0 )
{
$article->text = $this->doSomethingWith($article->text);
}

public function onContentPrepare($context, &$row, &$params, $page = 0)
{
// Danger, Will Robinson! $row in Joomla! 1.6/1.7 may be a string, not an article object!
if(is_object($row)) {
return $this->onPrepareContent($row, $params, $page);
} else {
$row = $this->doSomethingWith($row);
}

return true;
}

private function doSomethingWith($text)
{
// Apparently, you have to do something here ;)
return $text;
}
}
</source>

== Updating doesn't work as you'd expect ==

There is a small but very disturbing bug in Joomla! 1.6. Updating a component whose manifest XML states version="1.5.0" doesn't allow you to run the SQL statements. Namely, the SQL files you specify under the "<install><sql>" tags won't run. You can neither use the new "<update>" tag. You are stuck with no way to run SQL commands on component update!

The ugly workaround is to create a file named script.foobar.php with the following contents:

<source lang="php">
<?php
define('_JEXEC') or die();

class Com_FoobarInstallerScript {

function update($parent) {
$db = JFactory::getDBO();
// Obviously you may have to change the path and name if your installation SQL file ;)
if(method_exists($parent, 'extension_root')) {
$sqlfile = $parent->getPath('extension_root').DS.'install.sql';
} else {
$sqlfile = $parent->getParent()->getPath('extension_root').DS.'install.sql';
}
// Don't modify below this line
$buffer = file_get_contents($sqlfile);
if ($buffer !== false) {
jimport('joomla.installer.helper');
$queries = JInstallerHelper::splitSql($buffer);
if (count($queries) != 0) {
foreach ($queries as $query)
{
$query = trim($query);
if ($query != '' && $query{0} != '#') {
$db->setQuery($query);
if (!$db->query()) {
JError::raiseWarning(1, JText::sprintf('JLIB_INSTALLER_ERROR_SQL_ERROR', $db->stderr(true)));
return false;
}
}
}
}
}
}
</source>

Reference that file in the end of your manifest XML file, just above the closing install tag, with:
<source type="xml">
<scriptfile>script.foobar.php</scriptfile>
</source>

This will force Joomla! 1.6 to run your extension's installation SQL file during the component update, just like Joomla! 1.5 used to do. Enjoy!

== Menu item creation tricks ==

===For Joomla! 1.5===

You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration><code> tag.

<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>
or
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">Example Component</menu>
</source>

In both cases, you need to create a file named en-GB.com_example.menu.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation). In the first case (using a translation key), its contents should be:
<source>
COM_EXAMPLE=Example Component
</source>
In the second case (using natural language strings) its contents should be
<source>
Example Component=Example Component
</source>

NB: Joomla! 1.5 sorts the Component menu items based on the key you supply in your XML manifest. If you use the COM_EXAMPLE approach, your component will be sorted with all the components beginning with "C", e.g. just before Contacts on a fresh Joomla! 1.5 installation, no matter what the translation is! This leads to funny results, especially with non-English languages where the translated component names do not follow the same sorting order as their English names. If you are bilingual or multilingual, I think you know what I mean…

===For Joomla! 1.6 and later versions===

You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration></code> tag.
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>

You can not use a natural language string. Doing so will result in your component name appearing as example-component in the menu and you will be unable to provide a translation.

You need to create a file named en-GB.com_example.sys.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation) or in administrator/components/com_example/language/en-GB. In the latter case, you must not include the translation file in the <code><languages></code> tag. As long as you have placed the language directory in your <code><files></code> tag, it will be copied along when the component is being installed.

The contents of that file should be:
<source>
COM_EXAMPLE="Example Component"
</source>

Please note that the language string must be enclosed in double quotes, as per Joomla!'s translation standards.

NB: Joomla! 1.6 and later sorts the Component menu items based on the actual translation of the key you supply in your XML manifest. This means that the sorting order is correct no matter what you call your translation key and no matter which language the site is being displayed in. Essentially, Joomla! 1.6 fixed the wrong sorting of the Components menu for the majority (non-English speaking!) of Joomla! users.

===How to have a cross-version (Joomla! 1.5, 1.6 and later) component===

If your component is supposed to be installed under both Joomla! 1.5 and Joomla! 1.6/1.7/2.5, you can do a little trick. You have to add a line similar to the following in your component's manifest XML file, inside the <code><administration></code> tag.
<source lang="xml">
<menu view="yourview" img="../media/com_example/logo-16.png">COM_EXAMPLE</menu>
</source>

Now, you need to create two files, one for Joomla! 1.5 and one for Joomla! 1.6. For Joomla! 1.5 you need to create a file named en-GB.com_example.menu.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation). Its contents should be:
<source>
COM_EXAMPLE=Example Component
</source>
For Joomla! 1.6 you need to create a file named en-GB.com_example.sys.ini in administrator/languages/en-GB (you can use the manifest's <code><languages></code> tag to copy it during installation) or in administrator/components/com_example/language/en-GB. In the latter case, you must not include the translation file in the <code><languages></code> tag. As long as you have placed the language directory in your <code><files></code> tag, it will be copied along when the component is being installed.

The contents of that file should be:
<source>
COM_EXAMPLE="Example Component"
</source>

The only drawback is that your component will appear as weirdly sorted in the Components menu of Joomla! 1.5. Given the very near expiration date of Joomla! 1.5 (April 2012) this is not a major drawback and experience shows that users don't really care that much.

===What if you do that and nothing happens?===

Joomla! is supposed to create the components menu entries afresh every time you re-install the component. If this doesn't happen in your case, try uninstalling and re-installing your component. If you're not sure if Joomla! has the correct Components menu item translation key, you can always check the menu items database table. This will prevent you from unnecessary frustration when your translation files don't work simply because Joomla! has the wrong translation key in the table.

== More tricks? ==

I am sure that by writing this page I have left out a number of tricks which I am already using in my software. If you get stuck somewhere, feel free to take a look at how I've implemented things in Admin Tools Core, Akeeba Backup Core and Akeeba Release System, my Joomla! 1.5/1.6/1.7 compatible extensions. If you find a better way to implement something, or found a trick not listed here, feel free to edit this wiki page. Sharing the knowledge is caring!

Peace, love and friendship,

Nicholas K. Dionysopoulos, AkeebaBackup.com Lead Developer

Archived:Vulnerable Extensions List

2010-07-02T11:35:16Z

Hidabe:

{{RightTOC}}
== Check and Report. ==

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic or the [http://forum.joomla.org/viewforum.php?f=470 extensions] topic clearly marked with the first word in the title being ''Vulnerable'' where the security moderators or JSST team will respond.
'''This list is change protected, for updates or editing requests [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]'''
*If you are seeing this page on any site other than [http://docs.joomla.org/Vulnerable_Extensions_List the Offical Joomla Documentation] you may be seeing an out of date version or experiencing [http://en.wikipedia.org/wiki/Plagiarism plagiary] and the links may not work properly

== How to use this list ==
'''Items will be removed after a suitable period and not on resolution'''
All known vulnerable extensions are the listed in the first column. Any in a red box are high where we have not been given a fix for. Alert Advisory details in the centre column (the date is in American format mm/dd/yyyy).
The link to the advisory notice.
Finally a link to the notice about any update with link or '''Not Known''' where none is known.

'''This list is compiled from found information and may not be an up to date accurate list''' ''We do '''NOT''' promise to test or validate these reports. We do '''NOT''' guarantee the quality or effectiveness of any updates reported to us or listed here.''
To sign up for the feed please [http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions follow this link]

== Developers - How to get yourself removed from the VEL ==

Resolved items will be removed after a suitable period and not on resolution

Please solve the issues and:

* If JED listed
Attach the new zip file at your actual JED listing.

Change the extension version at JED listing.

Contact the JED by mail back with a notice and ask them republish your listing.

* If not JED listed.
Inform us by PM of the link to your resolution notice on your website.

== November 2009 Compiled Vulnerability Reports. ==

Items are not in any particular order.

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''
|-
| style="background:#cef2e0; color:black" | '''com_ajaxchat'''
| Summary: PHP remote file inclusion vulnerability in Fiji Web Design Ajax Chat ('''com_ajaxchat''') component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter to tests/ajcuser.php.New version release December 22,2009
Published: october 28 2009
| [[NIST:CVE-2009-3822|CVE-2009-3822]]
| style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/communication/chat/10767 update v 1.1]
|-
| style="background:#cef2e0; color:black" | '''com_booklibrary'''
| PHP remote file inclusion vulnerability in doc/releasenote.php in the BookLibrary ('''com_booklibrary''') component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter, a different vector than [[NIST:CVE-2009-2637|CVE-2009-2637]]. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 10/28/2009
CVSS Severity: 7.5 (HIGH)
| [[NIST:CVE-2009-3817|CVE-2009-3817]]
| style="background:#cef2e0; color:black" | '''[http://ordasoft.com/Download/Joomla1.0-extensions/Joomla1.0-components/View-category.html developer site updates]'''
|-
| style="background:#cef2e0; color:black" | '''com_foobla_suggestions'''
| Summary: SQL injection vulnerability in the foobla Suggestions ('''com_foobla_suggestions''') component 1.5.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the idea_id parameter to index.php.
Published: 10/11/2009
CVSS Severity: 7.5 (HIGH)
| [[NIST:CVE-2009-3669|CVE-2009-3669]]
| style="background:#cef2e0; color:white" | [http://foobla.com/news/latest/fixed-foobla-suggestions-for-joomla-idea_id-sql-injection-vulnerability.html developer reported upgrade]
|-
| style="background:red; color:white" | '''com_djcatalog'''
| Summary: Multiple SQL injection vulnerabilities in the DJ-Catalog ('''com_djcatalog''') component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a showItem action and (2) cid parameter in a show action to index.php.
Published: 10/11/2009
CVSS Severity: 6.8 (MEDIUM)
| [[NIST:CVE-2009-3661|CVE-2009-3661]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_cbresumebuilder'''
| Summary: SQL injection vulnerability in the JoomlaCache CB Resume Builder (''''''com_cbresumebuilder''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a group_members action to index.php.
Published: 10/09/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3645|CVE-2009-3645]]
| style="background:#cef2e0; color:white" |'''[http://www.joomlacache.com/commercial-extensions/security-update.html Developer Update]'''
|-
| style="background:red; color:white" | '''com_soundset'''
| Summary: SQL injection vulnerability in the Soundset ('''com_soundset''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php.
Published: 10/09/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3644|CVE-2009-3644]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" |'''com_sportfusion'''
| Summary: SQL injection vulnerability in the Kinfusion SportFusion ('''com_sportfusion''') component 0.2.2 through 0.2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a teamdetail action to index.php.
Published: 09/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3491|CVE-2009-3491]]
| style="background:red; color:white" |'''Not Known'''
|-
| style="background:red; color:white" | '''com_icrmbasic'''
| Summary: A certain interface in the iCRM Basic ('''com_icrmbasic''') component 1.4.2.31 for Joomla! does not require administrative authentication, which has unspecified impact and remote attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 09/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3481|CVE-2009-3481]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_mytube'''
| Summary: SQL injection vulnerability in the MyRemote Video Gallery ('''com_mytube''') component 1.0 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter in a videos action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3446|CVE-2009-3446]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_fastball'''
| Summary: SQL injection vulnerability in the Fastball ('''com_fastball''') component 1.1.0 through 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the league parameter to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3443|CVE-2009-3443]]
| style="background:#cef2e0; color:white" | [http://www.fastballproductions.com latest version] 1.2.1
|-
| style="background:red; color:white" | '''com_facebook'''
| Summary: SQL injection vulnerability in the JoomlaFacebook ('''com_facebook''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a student action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3438|CVE-2009-3438]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_tupinambis'''
| Summary: SQL injection vulnerability in the Tupinambis ('''com_tupinambis''') component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the proyecto parameter in a verproyecto action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3434|CVE-2009-3434]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''com_idoblog'''
| Summary: SQL injection vulnerability in the IDoBlog ('''com_idoblog''') component 1.1 build 30 for Joomla! allows remote attackers to execute arbitrary SQL commands via the userid parameter in a profile action to index.php, a different vector than [[NIST:CVE-2008-2627|CVE-2008-2627]].
Published: 09/25/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3417|CVE-2009-3417]]
| style="background:#cef2e0; color:white" |'''[http://idojoomla.com/download.html/ '''New Version v 1.1''' (build 32)]'''
|-
| style="background:red; color:white" | '''com_hbssearch'''
| Summary: Cross-site scripting ('''XSS''') vulnerability in the Hotel Booking Reservation System ('''aka HBS or com_hbssearch''') component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the adult parameter in a showhoteldetails action to index.php.
Published: 09/24/2009
CVSS Severity: 4.3 ('''MEDIUM''')
| [[NIST:CVE-2009-3368|CVE-2009-3368]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_hbssearch'''
| Summary: Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System ('''aka HBS or com_hbssearch''') component for Joomla! allow remote attackers to execute arbitrary SQL commands via the ('''1''') h_id, ('''2''') id, and ('''3''') rid parameters to longDesc.php, and the h_id parameter to ('''4''') detail.php, ('''5''') detail1.php, ('''6''') detail2.php, ('''7''') detail3.php, ('''8''') detail4.php, ('''9''') detail5.php, ('''10''') detail6.php, ('''11''') detail7.php, and ('''12''') detail8.php, different vectors than [[NIST:CVE-2008-5865|CVE-2008-5865]], [[NIST:CVE-2008-5874|CVE-2008-5874]], and [[NIST:CVE-2008-5875|CVE-2008-5875]].
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3357|CVE-2009-3357]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''com_alphauserpoints'''
| Summary: SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints ('''com_alphauserpoints''') component 1.5.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the username2points parameter.
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3342|CVE-2009-3342]]
| style="background:#cef2e0; color:white" |'''[http://www.alphaplug.com/index.php/news/142-alphauserpoints-153-released.html 1.5.3]'''
|-
| style="background:red; color:white" | '''TurtuShout'''
| Summary: SQL injection vulnerability in the TurtuShout component 0.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Name field.
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3335|CVE-2009-3335]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_jinc'''
| Summary: SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component ('''aka JINC or com_jinc''') component 0.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a messages action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3334|CVE-2009-3334]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_jbudgetsmagic'''
| Summary: SQL injection vulnerability in the JBudgetsMagic ('''com_jbudgetsmagic''') component 0.3.2 through 0.4.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the bid parameter in a mybudget action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3332|CVE-2009-3332]]
| style="background:#cef2e0; color:white" | '''[http://sopinet.com/jbudgetsmagic/index.php?option=com_remository&Itemid=5&lang=en Update to 0.4.1]'''
|-
| style="background:red; color:white" | '''com_surveymanager'''
| Summary: SQL injection vulnerability in the Focusplus Developments Survey Manager ('''com_surveymanager''') component 1.5.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the stype parameter in an editsurvey action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3325|CVE-2009-3325]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_album'''
| Summary: Directory traversal vulnerability in the Roland Breedveld Album ('''com_album''') component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. ('''dot dot''') in the target parameter to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3318|CVE-2009-3318]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_jreservation'''
| Summary: SQL injection vulnerability in the [http://extensions.joomla.org/extensions/vertical-markets/booking-a-reservation/9798 JReservation] ('''com_jreservation''') component 1.0 and 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a propertycpanel action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3316|CVE-2009-3316]]
| style="background:#cef2e0; color:black" | [http://www.jforjoomla.com Updated 28th] Jan fixed 13th Nov
|-
| style="background:red; color:white" | '''IXXO Cart Standalone'''
| Summary: SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, and the IXXO Cart component for Joomla! 1.0.x, allows remote attackers to execute arbitrary SQL commands via the parent parameter.
Published: 09/16/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3215|CVE-2009-3215]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_digifolio'''
| Summary: SQL injection vulnerability in the DigiFolio ('''com_digifolio''') component 1.52 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a project action to index.php.
Published: 09/15/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3193|CVE-2009-3193]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_aclassf'''
| Summary: Cross-site scripting ('''XSS''') vulnerability in '''gmap.php''' in the Almond Classifieds ('''com_aclassf''') component 7.5 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the addr parameter.
Published: 09/10/2009
CVSS Severity: 4.3 ('''MEDIUM''')
| [[NIST:CVE-2009-3155|CVE-2009-3155]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_aclassf'''
| Summary: SQL injection vulnerability in the Almond Classifieds ('''com_aclassf''') component 7.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action to index.php, a different vector than [[NIST:CVE-2009-2567|CVE-2009-2567]].
Published: 09/10/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3154|CVE-2009-3154]]
| style="background:#cef2e0; color:white" | [http://www.almondsoft.com/alcl.html Developer latest component]
|-
| style="background:red; color:white" | '''com_jabode'''
| Summary: SQL injection vulnerability in Jabode horoscope extension ('''com_jabode''') for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.
Published: 09/08/2009
CVSS Severity: 7.5 ('''HIGH''')

| [[NIST:CVE-2008-7169|CVE-2008-7169]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_gameserver'''
| Summary: SQL injection vulnerability in the Game Server ('''com_gameserver''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a gamepanel action to index.php.
Published: 09/03/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3063|CVE-2009-3063]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_artportal'''
| Summary: SQL injection vulnerability in the Artetics.com Art Portal ('''com_artportal''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the portalid parameter to index.php.
Published: 09/03/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3054|CVE-2009-3054]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_agora'''
| Summary: Directory traversal vulnerability in the Agora ('''com_agora''') component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.
Published: 09/03/2009
CVSS Severity: 6.8 ('''MEDIUM''')
| [[NIST:CVE-2009-3053|CVE-2009-3053]]
| style="background:#cef2e0; color:white" |'''[http://jvitals.com/index.php?option=com_rokdownloads&view=file&Itemid=108&id=282:agora-3-0 3.0.7]'''
|-
| style="background:red; color:white" | '''com_simpleshop'''
| Summary: SQL injection vulnerability in the Simple Shop Galore ('''com_simpleshop''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the section parameter in a section action to index.php, a different vulnerability than [[NIST:CVE-2008-2568|CVE-2008-2568]]. NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
Published: 08/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-7033|CVE-2008-7033]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_groups'''
| Summary: SQL injection vulnerability in the Permis ('''com_groups''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a list action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 08/17/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-2789|CVE-2009-2789]]
| style="background:red; color:white" | '''Not Known'''

|-
| style="background:#cef2e0; color:black" | '''com_content'''
| Summary: SQL injection vulnerability in the content component ('''com_content''') 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a blogcategory action to index.php.
Published: 08/10/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6923|CVE-2008-6923]]
| style="background:#cef2e0; color:white" |'''[http://developer.joomla.org/security/news/305-20091103-core-front-end-editor-issue-.html Resolution]'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: SQL injection vulnerability in the Live Chat ('''com_livechat''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the last parameter to getChatRoom.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6883|CVE-2008-6883]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: Live Chat ('''com_livechat''') component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6882|CVE-2008-6882]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: Multiple SQL injection vulnerabilities in the Live Chat ('''com_livechat''') component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the last parameter to ('''1''') getChat.php, ('''2''') getChatRoom.php, and ('''3''') getSavedChatRooms.php.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6881|CVE-2008-6881]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''JUMI'''
| There is a backdoor in JUMI that installs itself when JUMI is installed on your web site. It sends your credentials to a website, and sets up a back door for remote code execution.
Please remove JUMI2.0.5 immediately.
It will be simple enough to remove the compromised code from this download, but you need to do
a full security audit on your site as well as you have been compromised. Added November 2009
| [http://code.google.com/p/jumi/updates/list Report]
| style="background:#cef2e0; color:white" |[http://code.google.com/p/jumi/updates/list Jumi Update]
|-
| style="background:#cef2e0; color:black" |'''com_photoblog'''
| Input Validation Error Added November 2009
| [http://www.securityfocus.com/bid/36809/ 36809]
| style="background:#cef2e0; color:white" |[http://webguerilla.net/downloads/3-components-for-joomla-1 webguerilla Photoblog alpha 3b]
|-
| style="background:red; color:white" | '''com_jshop'''
| Summary: SQL injection vulnerability in the JShop ('''com_jshop''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a product action to index.php.
Published: 11/02/2009
CVSS Severity: 7.5 '''(HIGH)'''
| [[NIST:CVE-2009-3835|CVE-2009-3835]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''BF Survey Pro'''
| Summary: SQL injection vulnerability in the '''BF Survey Pro''' v1.2.5 or lower (fixed in version 1.2.6). '''BF Survey Basic v1.0''' (fixed in version 1.1). '''BF Quiz v1.1.1''' (fixed in version 1.2 or greater) Added November 2009
| [http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.0 tamlyncreative.com.au]
| style="background:#cef2e0; color:white" |[http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.0 update]
|-
| style="background:#cef2e0; color:black" |'''Joo!BB 0.9.1 '''
| Summary: Persistent XSS/MySQL Injection vulnerabilities in Joo!BB 0.9.1 Added November 2009
| [http://www.joobb.org/community/board/topic/700-MultipleXSSSQLInjectionVulnerabilities.html joob.org]
| style="background:#cef2e0; color:white" |[http://www.joobb.org/downloads/components.html update]
|-
| style="background:#cef2e0; color:black" |'''sh404sef '''
| Summary: sh404sef URI XSS Vulnerability Added November 2009
| [http://jeffchannell.com/Joomla/sh404sef-uri-xss-vulnerability.html jeffchannell.com]
| style="background:#cef2e0; color:white" |[http://extensions.siliana.com/en/2009060876/sh404SEF-and-url-rewriting/Interim-release-of-sh404sef-for-Joomla-1.5.x.html update]
|-
| style="background:#cef2e0; color:black" | '''AWD Wall 1.5'''
| Summary '''AWD Wall 1.5''' Blind SQL Injection Vulnerability.The Joomla component AWD Wall 1.5 suffers from an SQL Injection vulnerability in its handling of the 'cbuser' parameter.Added November 2009
| [http://jeffchannell.com/Joomla/awd-wall-15-blind-sql-injection-vulnerability.html Notice]
|style="background:#cef2e0; color:white" | '''[http://www.awdsolution.com/template_demo/testsite/index.php?option=com_content&view=article&id=48&Itemid=72 developer update]'''
|-
| style="background:red; color:white" | '''EasyBook 2.0.0rc4'''
| Summary: The Joomla component '''EasyBook 2.0.0rc4''' suffers from multiple persistent XSS vulnerabilities. One seems fairly critical, while the others would take some incredible creativity to actively exploit. Added November 2009
| [http://jeffchannell.com/Joomla/easybook-200rc4-multiple-xss-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''F!BB 1.5.96'''
| Summary: The Joomla component '''F!BB 1.5.96 RC''' suffers from multiple persistent XSS vulnerabilities, as well SQL Injection in its user search feature. Added November 2009
| [http://jeffchannell.com/Joomla/fbb-1596-rc-multiple-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''Testimonial Ku 2.0 Admin Panel'''
| Summary: The Joomla component '''Testimonial Ku 2.0''' is vulnerable to persistent XSS in the administrator panel. A malicious user can submit a testimonial containing <script> tags with absolutely no quotes and inject that script into the administrator panel through any of the available inputs except "email". Added November 2009
| [http://jeffchannell.com/Joomla/testimonial-ku-20-admin-panel-persistent-xss.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''MS Comment 0.8.0b'''
| Summary '''MS Comment 0.8.0b for Joomla''', a commenting plugin, suffers from an multiple vulnerabilities. Added November 2009
| [http://jeffchannell.com/Joomla/ms-comment-080b-multiple-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:#cef2e0; color:black" | '''!JoomlaComment 4.0 beta1'''
| Summary: '''!JoomlaComment 4.0 beta1''', a commenting plugin, suffers from multiple XSS vulnerabilities. Added November 2009
| [http://jeffchannell.com/Joomla/joomlacomment-40-beta1-multiple-xss-vulnerabilities.html Alert]
| style="background:#cef2e0; color:white" | ''' [http://compojoom.com/blog/8-news/121-joomlacomment-40-rc1-released Developer Notice 4.0 rc1]''
|-
| style="background:red; color:white" | '''WebAmoeba Ticket System 3.0.0'''
| Summary: '''WebAmoeba Ticket System 3.0.0''', a Joomla help desk component. The vulnerability is with the BBCode library used to parse BBCode tags, as it does not strip javascript: urls from [url] tags. Added November 2009
| [http://jeffchannell.com/Joomla/webamoeba-ticket-system-300-bbcode-xss.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Kunena 1.5.x'''
|Summary: This is an important security release and users are urged to update immediately. Five security issues and an Internet Explorer 8 table bug have been resolved in this release. This release also contains many other important bug fixes. Added 18 November 2009
|[http://www.kunena.com/blog/19-developer-blog/51-kunena-157-security-release-now-available Advisory]
|style="background:#cef2e0; color:white" |[http://www.kunena.com/blog/19-developer-blog/52-kunena-158-service-release-now-available Latest 1.5.8 Version]
|-
| style="background:red; color:white" | '''com_siirler'''
| Summary: SQL injection vulnerability in the '''Q-Proje Siirler Bileseni (com_siirler)''' component 1.2 RC for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in an sdetay action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3972 | CVE-2009-3972]]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''jTips (com_jtips)'''
|SUmmary:SQL injection vulnerability in the '''jTips (com_jtips)''' component 1.0.7 and 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the season parameter in a ladder action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3971 |CVE-2009-3971]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''NinjaMonials'''
| Summary: SQL injection vulnerability in the '''NinjaMonials (com_ninjacentral)''' component 1.1.0 for '''Joomla 1.0.x''' ! allows remote attackers to execute arbitrary SQL commands via the testimID parameter in a display action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3964 | CVE-2009-3964]]
|style="background:#cef2e0; color:white" |''' [http://ninjaforge.com/index.php?option=com_ninjacentral&page=show_package&id=14&Itemid=235 developer patch Ver 1.2]'''
|-
|style="background:#cef2e0; color:black" | '''webee 1.1.1 &1.2'''
|Summary: '''webee 1.1.1,''' a Joomla commenting plugin, suffers from multiple vulnerabilities. '''webee has been updated to 1.2''' as of 12 November 2009 and''' still suffers''' from SQL Injection. XSS was not tested in 1.2. Added 19 November 2009
| [http://jeffchannell.com/Joomla/webee-111-multiple-vulnerabilities.html jeffchannell.com]
|style="background:#cef2e0; color:white" | ''' [http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/10155 developer update ver2.0]'''
|-
|style="background:#cef2e0; color:black" |'''iF Portfolio Nexus'''
|Summary: The '''iF Portfolio Nexus component for Joomla!''' is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements using the id parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. Nov 18, 2009
|[http://secunia.com/advisories/37408/ secunia.com 37408/]
|style="background:#cef2e0; color:white" |[http://www.inertialfate.za.net/help/forums/topic?id=10&p=3#p172 iF Portfolio Nexus v1.1.1 released]

|-
|style="background:red; color:white" | '''JoomClip'''
|Summary: The '''JoomClip component for Joomla!''' is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the index.php script using the cat parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. Nov 18, 2009
|[http://secunia.com/advisories/37400/ secunia.com 37400/]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Joomla XML'''
|Summary: Joomla! before 1.5.15 allows remote attackers to read an extension's XML file, and thereby obtain the extension's version number, via a direct request.
Published: 11/16/2009
|[[NIST:CVE-2009-3946 | CVE-2009-3946]]
|style="background:#cef2e0; color:white" |'''[http://developer.joomla.org/security/news/306-20091103-core-xml-file-read-issue.html Resolution]'''
|-
|style="background:red; color:white" | '''Mygallery Remote SQL Injection Vulnerability'''
|Summary: Joomla Component mygallery ( farbinform_krell) Remote SQL Injection Vulnerability Added 27 Nov 2009 {{JVer|1.5}} NB: This could be an error in our database as the only one we could find was for wordpress.If anyone know of one for joomla please let us know..(poss joomlicious.com CM)
|[http://www.exploit-db.com]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Extreme Google Calendar'''
|Summary: '''com_gcalendar 1.1.2''' (gcid) Remote SQL Injection Vulnerability
Remote SQL Injection were identified in Google Calendar Component [http://extensions.joomla.org/extensions/calendars-a-events/calendars/4188 Extension Link] Added 27 Nov 2009
|[http://www.exploit-db.com reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''LyftenBloggie'''
| Summary: [http://www.lyften.com/products/lyftenbloggie.html LyftenBloggie] Component "author" SQL Injection Vulnerability LyftenBloggie 1.x Added 27 Nov 2009
|[http://secunia.com/advisories/product/28005/ SA37499]
| [http://jeffchannell.com/Joomla/lyften-bloggie-sql-injection-fix.html Un official fix]. Developer fix not release at 30 Nov 09 ''' [http://www.lyften.com/products/lyftenbloggie/extensions/download/id-20.html 1.0.4a (last update on Dec 28, 2009)]'''
|-
|style="background:#cef2e0; color:black" |'''Sermon speaker'''
|Summary: [http://joomlacode.org/gf/project/sermon_speaker sermon speaker] sql vulnerability and password reset vulnerability version 3.2 and below
|
|style="background:#cef2e0; color:white" |[http://joomlacode.org/gf/project/sermon_speaker/forum/?action=ForumBrowse&forum_id=7897&_forum_action=ForumMessageBrowse&thread_id=15219 Developer fix] 30 Nov 2009
|-
|style="background:#cef2e0; color:white" | [http://joomlacode.org/gf/project/musicgallery/ MusicGallery]
|Summary: [http://joomlacode.org/gf/project/musicgallery/ Component MusicGallery] SQL Injection Vulnerability 30 November {{JVer|1.5}}
|[[NIST:CVE-2009-4217 | CVE-2009-4217]]
|style="background:#cef2e0; color:black" | [http://joomlacode.org/gf/project/musicgallery/ developer]
|}

----

== December 2009 Compiled Reports ==
{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''
|-
|style="background:red; color:white" | '''Omilen Photo Gallery'''
|Summary: Directory traversal vulnerability in the [http://extensions.joomla.org/extensions/photos-&-images/photo-flash-gallery/6373/details Omilen Photo Gallery] (com_omphotogallery) component Beta 0.5 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php.
Published: 12/04/2009
|[[NIST:CVE-2009-4202 | CVE-2009-4202]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Seminar'''
|Summary: SQL injection vulnerability in the [http://seminar.vollmar.ws/ Seminar] (com_seminar) component 1.28 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a View_seminar action to index.php.
Published: 12/04/2009
|[[NIST:CVE-2009-4200 | CVE-2009-4200]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Mambo Resident'''
|Summary: Multiple SQL injection vulnerabilities in the Mambo Resident (aka Mos Res or com_mosres) component 1.0f for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) property_uid parameter in a viewproperty action to index.php and the (2) regID parameter in a showregion action to index.php. Mambo Resident component for v4.5.2 '''may only be for 1.0.xx versions of J!'''
Published: 12/04/2009
|[[NIST:CVE-2009-4199 | CVE-2009-4199]]
|style="background:#cef2e0; color:white" |[http://www.jomres.net/ Replacement Extension 08 dec 09]
|-
|style="background:red; color:white" | '''ProofReader'''
|Summary: Multiple cross-site scripting (XSS) vulnerabilities in index.php in the ProofReader (com_proofreader) component 1.0 RC9 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in (1) 404 or (2) error pages. Published: 12/02/2009 CVSS Severity: 4.3 (MEDIUM)
| [[NIST:CVE-2009-4157 | CVE-2009-4157]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Laoneo Google Calendar GCalendar'''
|Summary: SQL injection vulnerability in the [http://g4j.laoneo.net/content/extensions/download/cat_view/20-joomla-15x/21-gcalendar.html Google Calendar GCalendar] (com_gcalendar) component 1.1.2, 2.1.4, and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the gcid parameter. NOTE: some of these details are obtained from third party information. Published: 11/29/2009 CVSS Severity: 7.5 (HIGH) Note: There is already a listing for GCalendar 1.1.2
|[[NIST:CVE-2009-4099 | CVE-2009-4099]]
|style="background:#cef2e0; color:white" | [http://g4j.laoneo.net/content/extensions/download/doc_details/28-gcalendar-suite-215.html Latest version GCalendar Suite 2.1.5]
|-
|style="background:red; color:white" | '''D4J eZine'''
|Summary: PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS mosConfig_absolute_path parameter. Published: 11/29/2009 CVSS Severity: 7.5 (HIGH)
|[[NIST:CVE-2009-4094 | CVE-2009-4094]]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''Quick News'''
| Summary: The Joomla [http://joomlacode.org/gf/project/quicknews/ Quick News component] suffers from a remote SQL injection vulnerability. added 1st Dec 09
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Joaktree component'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/genealogy/9842 Joaktree] Vulnerability : SQL injection/ added 1st Dec 09
|[http://securityreason.com/exploitalert/7508 7508]
|style="background:#cef2e0; color:white" | ''' [http://naastniels.nl/index.php/en/joaktree/downloads version 1.1 update]'''
|-
|style="background:red; color:white" | '''mojoblog'''
|Summary [http://www.joomlify.com/files/mojoblog/ MojoBlog] Multiple Remote File Include Vulnerability added 1st Dec 09 {{JVer|1.5}}
|[http://securityreason.com/exploitalert/7509 7509]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''YJ Whois'''
|Summary: [http://extensions.joomla.org/extensions/external-contents/domain-search/5774 YJ Whois] '''Low security risk''',and fixesMalicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. Files affected is , modules/mod_yj_whois.php added 3 December 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" |[http://www.youjoomla.com/xss-security-patch-for-yj-whois.html Developer Notice and fix 03 dec 09]
|-
|style="background:#cef2e0; color:black" | '''yt_color YOOOtheme'''
|Summary: [http://www.yootheme.com/ YT_color yootheme] Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. added 5 dec 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.yootheme.com/member-area/downloads/item/templates-15/xss-and-php-53-patches All members without an active membership can download the template patches here].'''
|-
|style="background:red; color:white" | '''TP Whois'''
|summary: [http://www.templateplazza.com/view-details/tpwhois/183-component-tp-whois-for-joomla-1.5.x.html TP Whois ] Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. Added 3 december {{JVer|1.5}}
|[http://www.exploit-db.com Refrence]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_job'''
|Summary: Component com_job ( showMoreUse) SQL injection vulnerability Added 9th Dec
|[http://xforce.iss.net/xforce/xfdb/54626 Reference]
| style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''JQuarks'''
|Summary: [http://extensions.joomla.org/extensions/contacts-and-feedback/quiz-a-surveys/10590 JQuarks] SQL injection vulnerability {{JVer|1.5}} added 8th dec 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | [http://www.iptechinside.com/labs/projects/list_files/jquarks Developer Update ]
|-
|style="background:red; color:white" | '''Mamboleto Component 2.0 RC3'''
|Summary: [http://www.fernandosoares.com.br/index.php?option=com_docman&task=cat_view&gid=28&Itemid=28 Mamboleto Component 2.0 RC3]SQL injection vulnerability {{JVer|1.5}} added 12 December
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:#cef2e0; color:black" | ''' JS JOBS'''
|Summary [http://www.joomshark.com/index.php?option=com_content&view=article&id=4&Itemid=8 JS JOBS] Joomla Component com_jsjobs 1.0.5.6 SQL Injection Vulnerabilities {{JVer|1.5}} added 12 December
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.joomsky.com/index.php?option=com_rokdownloads&view=folder&Itemid=3&id=2:components Developer update 1.0.5.7]'''
|-
|style="background:#cef2e0; color:black" | '''corePHP JPhoto'''
|Summary: [http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10365 'corePHP' JPhoto]SQL injection vulnerability {{JVer|1.5}} added 12 December
|[http://secunia.com/advisories/37676/ Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.corephp.com/blog/uber-fast-jphoto-security-release/ Developer Upgrade]'''
|-
|style="background:#cef2e0; color:black" | '''com_virtuemart'''
|Summary: "com_virtuemart" http://virtuemart.net/ '''Version : 1.0''' Vulnerability : SQL injection added Date : 07- dec -09 {{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" |[http://virtuemart.net/ latest version]
|-
|style="background:red; color:white" | ''' Kide Shoutbox'''

|Summary: The Kide Shoutbox (com_kide) component 0.4.6 for Joomla! does not properly perform authentication, which allows remote attackers to post messages with an arbitrary account name via an insertar action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Added: December 08
|[[NIST:CVE-2009-4232 | CVE-2009-4232]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | ''' JoomPortfolio Component'''
|Summary: [http://www.joomplace.com/joomportfolio/joomportfolio.html JoomPortfolio] Input passed via the "secid" parameter to index.php (when "option" is set to "com_joomportfolio" and "task" is set to "showcat") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.The vulnerability is reported in version 1.0.0. Other versions may also be affected. Added: December 18 {{JVer|1.5}}
|[http://secunia.com/advisories/37838/ Reporting Site]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''City Portal (templates?)'''
|Summary: City Portal Blind SQL Injection Vulnerability added: 2009-12-18
|[http://www.exploit-db.com Reference] Possibly this [http://www.youjoomla.com/jclick-city-portal-joomla-template.html tempate]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Event Manager'''
|Summary: [http://www.jforjoomla.com/Joomla-Components/event-manager-15-component.html Event Manager] Blind SQL Injection Vulnerability EDB-ID: 10549
added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | com_zcalendar
|Summary: com_zcalendar Blind SQL-injection Vulnerability
EDB-ID: 10548 added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_acmisc'''
|Summary: com_acmisc SQL injection added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''com_digistore'''
|Summary: com_digistore SQL injection EDB-ID: 10546 added: 2009-12-18 {{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.ijoomla.com/ijoomla-digistore/ijoomla-digistore/ijoomla-digistore-change-log/ Update change log] '''
|-
|style="background:red; color:white" | '''com_jbook'''
|Summary: com_jbook Blind SQL-injection EDB-ID: 10545 added: 2009-12-18 {{JVer|1.0}}
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_personel'''
|Summary: com_personel component for Joomla! is vulnerable to SQL injection.
|[http://xforce.iss.net/xforce/xfdb/54903 iss.net reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''JEEMA Article Collection'''
|Summary: [http://www.forum.jeema.net/component/content/article/4-jeema-article-collection-component/13-about-jeema-article-collection.html JEEMA Article Collection] Input passed via the "catid" parameter to index.php (when "option" is set to "com_jeemaarticlecollection" and "view" is set to "longlook") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. version 1.0.0.1 {{JVer|1.5}} added 22 dec 09
| [http://secunia.com/advisories/37865/ secunia]
|style="background:#cef2e0; color:white" | [http://www.jeema.net/downloads/free-joomla-extensions/joomla-components/12-jeema-joomla-article-collection.htm fixed the same in the version v102.]
|-
|style="background:red; color:white" | '''HotBrackets Tournament Brackets '''
|Summary: The [http://extensions.joomla.org/extensions/sports-a-games/sports/10746 HotBrackets Tournament Brackets] component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. {{JVer|1.5}} added 22 dec
|[http://www.securityfocus.com/bid/37439/ Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Car Manager'''
|Summary: http://webformatique.com/ com_carman Cross Site Scripting Vulnerability added 24 december 09{{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" |'''Schools component'''
|Summary: The 'com_schools' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|[http://www.securityfocus.com/bid/37469 Reference] added 24 dec 09
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''webcamxp'''
|[http://extensions.joomla.org/extensions/communication/video-conference/4490 com_webcamxp] Cross Site Scripting Vulnerabilities Last version 2008 {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''beeheard'''
|[http://extensions.joomla.org/extensions/contacts-and-feedback/testimonials-a-suggestions/10283 beeheard] Blind SQL injection Vulnerability {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://beeheard.cmstactics.com/change-log Version 1.4.2] 04 Jan'''
|-
|style="background:red; color:white" | '''jm-recommend'''
|jm-recommendCross Site Scripting Vulnerabilities. unable to locate on jed. {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | facileforms
| com_facileforms Cross Site Scripting Vulnerabilities. unable to locate on jed. Product considered retired. {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''adagency'''
| [http://www.ijoomla.com/ijoomla-ad-agency/ijoomla-ad-agency/index/ adagency ]Vulnerabilities {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_intuit'''
|[http://www.san-diego-web-designer.com/new-file-download/item/root/aboutimage-igateway-for-joomla.html com_intuit]Local File Inclusion Vulnerability {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.securityfocus.com/bid/37494/discuss Retired]'''
|-
|style="background:red; color:white" | '''MemoryBook'''
|[http://extensions.joomla.org/extensions/calendars-a-events/birthdays-a-historic-events/10868 MemoryBook 1.2] Multiple Vulnerabilities. requires: magic quotes OFF, user account {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''qpersonel'''
|[http://extensions.joomla.org/extensions/directory-a-documentation/thematic-directory/7049 qpersonel ] Cross Site Scripting Vulnerabilities {{JVer|1.0}}[[Image:http://extensions.joomla.org/images/jed/compat_15_legacy.png]] Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''opryknings point'''
|com_oprykningspoint_mc Cross Site Scripting Vulnerabilities {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''trabalhe conosco'''
|com_trabalhe_conosco Cross Site Scripting Vulnerabilities {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''DhForum'''
|com_dhforum SQL Injection Vulnerability. considered retired/EOL Dec. 27 {{JVer|1.0}}1.5 legacy
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''com_morfeoshow'''
|[http://extensions.joomla.org/extensions/photos-a-images/photo-gallery-add-ons/9810 morfeoshow] this was a false report
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:black" | ''' false report'''
|-
|style="background:#cef2e0; color:black" |'''Run Digital Download rd-download'''
|[http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7838 RD Download] Local File Disclosure Vulnerability {{JVer|1.5}} Dec. 30 Version affected not disclosed.
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7838 Version 0.9 relased]
|-
|
|
|
|
|}

----

== January 2010 Reported Vulnerable Extensions ==

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic or the [http://forum.joomla.org/viewforum.php?f=470 extensions] topic clearly marked with the first word in the title being ''Vulnerable'' where the security moderators or JSST team will respond.
''This list is change protected, for updates or editing requests [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
''

[http://docs.joomla.org/Vulnerable_Extensions_List Back To Top]

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''

|-
|style="background:#cef2e0; color:black" |JvideoDirect
|Summary: [http://extensions.joomla.org/extensions/multimedia/video-players-a-gallery/9501 Jvideodirect] SQLi Jan 29
|
|http://www.jvideodirect.com/ Update version 2.5
|style="background:red; color:white" | ''' '''
|-
|style="background:#cef2e0; color:black" |'''JEvent search plugin'''
|Summary: JEvent search plugin for [http://extensions.joomla.org/extensions/calendars-a-events/events/95 JEvent] SQLi reported Jan 29
|
|style="background:#cef2e0; color:white" | ''' [http://www.jevents.net/forum/viewtopic.php?f=17&t=3910#p15526 upgrade to 1.5.3b]'''
|
|-
|style="background:#cef2e0; color:black" |'''Kunena'''
|Summary: [http://extensions.joomla.org/extensions/communication/forum/7256/details kunena] re reported suffering SQLi in version 1.5.9 Jan 29 Confirmation Required '''Now found to be malicious'''
|
|style="background:#cef2e0; color:black" | ''' [http://www.kunena.com/blog/19-developer-blog/51-kunena-157-security-release-now-available Versions 1.5.5 and below only]'''
|
|-
|style="background:red; color:white" |'''JE Quiz'''
|Summary : http://extensions.joomla.org/extensions/contacts-and-feedback/quiz-a-surveys/11212 JeQuiz SQLi reported 29 Jan
|
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black"" |'''idoblog'''
|summary: exploitable due to open file permissions. 28 Jan
|Private Notification
|style="background:#cef2e0; color:black" | ''' [http://idojoomla.com/news.html build 35 released] '''
|-
|style="background:#cef2e0; color:black" |'''ccnewsletter'''
|Summary [http://extensions.joomla.org/extensions/5112/details ccnewsletter Directory Traversal Vulnerability] Jan 28
|Private Notification
|style="background:#cef2e0; color:white" | ''' [http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html version 1.0.6 released 29 Jan]'''
|-
|style="background:#cef2e0; color:white" |'''Virtuemart 1.1.4'''
|Summary: [http://extensions.joomla.org/extensions/e-commerce/shopping-cart/129 virtuemart] Input var order_status_id is vulnerable to SQLi NB Requires Higher Level access before exploiting. Jan 27
|
|style="background:#cef2e0; color:black" | ''' [http://forum.joomla.org/viewtopic.php?p=2027005#p2027005 developer patches]'''
|-
|style="background:#cef2e0; color:black" |'''JBDiary'''
|Summary: [http://extensions.joomla.org/extensions/calendars-a-events/events/11009 JBDiary] BLIND SQL Injection Vulnerabilities Jan 24 [http://www.jb-soft.nl/ http://www.jb-soft.nl/]
|
|style="background:#cef2e0; color:white" | ''' [http://www.jb-soft.nl/index.php?option=com_content&view=article&id=64 Developer Update 27 Jan]'''
|-
|style="background:#cef2e0; color:black" |'''JbPublishDownFp'''
|Sumary: [http://extensions.joomla.org/extensions/news-production/timed-content/6496 JbPublishDownFp] SQL Injection Vulnerability Jan 24 [http://www.jb-soft.nl http://www.jb-soft.nl]
|
|style="background:#cef2e0; color:white" |''' [http://www.jb-soft.nl/index.php?option=com_content&view=article&id=64 Developer Update Jan 27]'''
|-
|style="background:red; color:white" |'''com_casino'''
|Summary: [http://extensions.joomla.org/extensions/sports-a-games/tips-a-betts com_casino]
SQL Injection Vulnerabilities Jan24
|
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Mochigames'''
|Summary: [http://extensions.joomla.org/extensions/search/mochigames com_Mochigames]
SQL Injection Vulnerabilities Jan24
|
|style="background:#cef2e0; color:white" | ''' [http://www.yoflash.com/download.html mochigames_alpha052 Released]'''
|-
|style="background:red; color:white" |'''ContentBlogList'''
|Summary: [http://extensions.joomla.org/extensions/news-production/blog/10989 com_ContentBlogList] SQL Injection Vulnerability Jan 23
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |MailChimp for Joomla 1.5
|Summary: [http://extensions.joomla.org/extensions/bridges/mailing-a-newsletter-bridges/7836 MailChimp for Joomla 1.5] jan 17
|Developer Statement
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''JoomlaXML'''
|Summary: [http://extensions.joomla.org/extensions/tools/design-tools/5020 JoomlaXML] malicious code insertion
|
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''JVClouds3D SWF module'''
|[http://joomlapro.ru/3djvclouds JVClouds3D SWF module] Cross Site Scripting . jan 14
|[http://xforce.iss.net/xforce/xfdb/55535 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''JVClouds3D'''
|[http://joomlapro.ru/3djvclouds JVClouds3D module] Cross Site Scripting . jan 14
|[http://xforce.iss.net/xforce/xfdb/55534 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''JA Showcase'''
|[http://www.joomlart.com/addons/components_and_modules/ja_showcase.html JA Showcase component] Directory Traversal jan 14
|[http://xforce.iss.net/xforce/xfdb/55512 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''jprojects'''
|Summary: Unknown Author com_j-projects Blind SQL Injection Vulnerability. Jan 10 detail update
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''jEmbed-Embed Anything'''
|[http://www.joshprakash.com/index.php?option=com_docman&task=doc_details&gid=70 jEmbed-Embed Anything] A vulnerability has been discovered in the jEmbed-Embed Anything component for Joomla, which can be exploited by malicious people to conduct SQL injection attacks. Jan 10
|[http://secunia.com/advisories/38112 Secunia Advisory: SA38112]
|style="background:red; color:white" | [http://extensions.joomla.org/extensions/3699/details Product considered retired]
|-
|style="background:#cef2e0; color:black" |'''perchagallery '''
|Summary: perchagallery [http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10350 com_perchagallery] SQL Injection Vulnerability Jan 7
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.percha.com/index.php?option=com_phocadownload&view=file&id=22:1.5&Itemid=20 Developer Update 1.5b]'''
|-
|style="background:#cef2e0; color:black" | '''CARTwebERP'''
|Summary: [http://extensions.joomla.org/extensions/bridges/e-commerce-bridges/8753 CARTwebERP] Local File Inclusion Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://extensions.joomla.org/extensions/bridges/e-commerce-bridges/8753 1.56.76 (last update on Jan 11, 2010)]'''
|-
|style="background:#cef2e0; color:black" | '''JoomlaBibleStudy'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/religion/3461 JoomlaBibleStudy] LFI Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | '''[http://joomlabiblestudy.org/invisible-downloads/category/3-component.html Developer reported update]'''
|-
|style="background:#cef2e0; color:black" | '''com_bfsurvey_basic and pro'''
|Summary: [http://www.tamlyncreative.com.au/software/ BFsurvey] SQL Injection Vulnerability ,LFI Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.tamlyncreative.com.au/software/forum/index.php?topic=641.0 Developer Update announcement]'''
|-
|style="background:red; color:white" | '''Alfresco'''
|Summary: SQL Injection Vulnerability. Not believed to be Joomlatools extension Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''abbrev'''
|Summary: [http://extensions.joomla.org/extensions/directory-a-documentation/glossary-a-dictionary/4965 abbrev] Local File Inclusion Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''countries'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/development/6553 countries] SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Dedicated Component com_tpjobs'''
|Summary: [http://www.templateplazza.com/ tpjobs] SQL Injection Vulnerability unable to locate files probably template plaza Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.templateplazza.com/extensions-updates/tpjobs-component-update-v-1.1.html Developer Update] '''
|-
|style="background:red; color:white" | '''Component com_doqment'''
|SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Component com_otzivi'''
|Blind SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''aprice'''
|Summary: [http://adeptweb.info/component/option,com_aprice/Itemid,109/ com_aprice] Component 'analog' Parameter SQL Injection Vulnerability
|[http://www.securityfocus.com/bid/37575 Report]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''cartikads'''
|Summary: [http://www.cartikahosting.com com_cartikads] Remote File Upload Vulnerability
'''Mambo''' Open Source ads management component
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Docman seller'''
|Summary: [http://extensions.joomla.org/extensions/e-commerce/subscriptions/5000 Document seller] Input passed via the "id" parameter to index.php (when "option" is set to "com_dm_orders", "task" is set to "order_form", and "payment_method" is set to "Paypal") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
|[http://secunia.com/advisories/38024/ secunia]
|style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/e-commerce/subscriptions/5000 Updated 10th Jan]
|-
|style="background:#cef2e0; color:black" | '''ozio gallery'''
|summary: [http://extensions.joomla.org/extensions/photos-a-images/photo-flash-gallery/4883 Ozio Gallery2] SQLi eploit
|[http://www.viruslist.com/en/advisories/37974 Reference]
|style="background:#cef2e0; color:white" |[http://oziogallery.joomla.it/index.php?option=com_content&view=article&id=62%3Anuova-ozio-gallery-23-aggiornamento-di-sicurezza&catid=2%3Anotizie&Itemid=13&lang=en developer update Jan 11]
|-
|style="background:#cef2e0; color:black" | '''RD-Autos Free'''
|[http://extensions.joomla.org/extensions/vertical-markets/vehicles/5458 RD-Autos Free ] This version is now commercial not free
|Private advisory to JED Jan 11
|style="background:red; color:white" | ''' Product Retired and replaced'''
|-
|style="background:red; color:white" | '''DailyMeals'''
|Summary: [http://extensions.joomla.org/extensions/vertical-markets/food-a-beverage/4764 dailymeals] Local File Inclusion Vulnerability Jan 02
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''RD-Autos Pro'''
|[http://extensions.joomla.org/extensions/vertical-markets/vehicles/6357 RD Autos Pro]
|Private advisory to JED Jan 11
|style="background:#cef2e0; color:black" | ''' Upgrade to Latest version be 2.0.2'''
|-
|
|
|
|
|}

== New format Feed Starts Here ==
Please do not change your [http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions feed url], only the feed format has changed.

== February, March, April, May, June 2010 Reported Vulnerable Extensions ==
<startFeed />

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic clearly marked with the first word in the title being ''Vulnerable Report'' where the security moderators or JSST team will respond. For a guide to the [http://docs.joomla.org/Vulnerable_Extensions_List_0210#Codes_used codes]

[http://docs.joomla.org/Vulnerable_Extensions_List Previous Reports]

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Date Added'''
! class="unsortable" |'''Extension Update Link & Date'''
|-
|style="background:red; color:white" |

== myblog controller ==
|LFI
http://www.azrul.com/
|010710
|[http://www.azrul.com/ MyBlog 3.0.332]
|-
|style="background:red; color:white" |

== joomanager ==
|SQli Vulnerability
http://www.joomanager.com
|010710
|
|-
|

== gamesbox ==
|SQL Injection Vulnerability
http://www.jooforge.com/en/download/commercial/extensions/39-gamesbox
|010710
|upgrade to 1.0.10
|-
|style="background:red; color:white" |

== wmtpic ==
|www.webmaster-tips.net various
|010710
|
|-
|style="background:red; color:white" |

== date converter ==
|http://sourceforge.net/projects/date-converter/ sqli
|010710
|
|-
|style="background:red; color:white" |

== Remository ==
|http://remository.com/ LFI (proc)
|010710
|
|-
|

== ==
|
|
|
|-
|style="background:red; color:white" |

== real estate ==
|http://www.opensourcetechnologies.com/demos/real-estate.html RFI
|210610
|
|-
|style="background:#cef2e0; color:black"|

== jomsocial ==
|Version: 1.6.288 Multiple XSS
|210610
|[http://www.jomsocial.com/blog/security-patch-for-jomsocial-16x.html 1.6.291 released] 220610

|-
|style="background:#cef2e0; color:black"|

== DOCman ==
|DOCman 1.5.7 DOCman 1.4.0 none specific exploit
|210610
|[http://blog.joomlatools.eu/2010/06/docman-security-announcement.html developer announcement]
|-
|style="background:red; color:white" |

== eportfolio ==
|http://www.joomplace.com/e-portfolio/e-portfolio-description.html Upload Vulnerability
|200610
|

|-
|style="background:red; color:white" |

== cinema ==
|SQL injection
|190610
|
|-
|style="background:red; color:white" |

== Jreservation ==
|http://jforjoomla.com/ SQLi Vulnerability
|190610
|
|-
|style="background:red; color:white" |

== Super Messenger ==
|axxis.gr xss
|190610
|
|-
|style="background:red; color:white" |

== joomdocs ==
|http://joomclan.com/index.php/JoomDocs/ xss vulnerability
|190610
|
|-
|style="background:#cef2e0; color:black"|

== RSComments 1.0.0 ==
|Persistent XSS NOTE: ONLY executes in backend!
|190610
|[http://www.rsjoomla.com/customer-support/documentations/96--general-overview-of-the-component/393-changelog.html Developer update announcement] 210610
|-
|style="background:red; color:white" |

== Live Chat ==
|http://www.joompolitan.com/livechat.html Multiple Remote Vulnerabilities
|190610
|
|-
|style="background:red; color:white" |

== Turtushout 0.11 ==
| http://www.turtus.org.ua/files?func=fileinfo&id=13 SQL Injection (again)
|190610
|
|-
|style="background:red; color:white" |

== BF Survey Pro Free ==
|BF Survey Pro Free SQL Injection Exploit
|190610
|
|-
|style="background:red; color:white" |

== MisterEstate ==
|http://www.misterestate.com/ Blind SQL Injection Exploit
|190610
|
|-
|style="background:red; color:white" |

== RSMonials ==
|http://www.rswebsols.com/downloads/category/14-download-rsmonials-all?download=23%3Adownload-rsmonials-component XSS Exploit
|190610
|Believed to be 1.5.1 version

|-
|style="background:#cef2e0; color:black"|

== RSComments 1.0.0 ==
|RS Comments 1.0.0 Multiple XSS Vulnerabilities http://www.rsjoomla.com (relisted)
|180610
|[http://www.rsjoomla.com/customer-support/documentations/96--general-overview-of-the-component/393-changelog.html Developer update announcement] 210610
|-
|style="background:red; color:white" |

== Answers v2.3beta ==
|Multiple Vulnerabilities http://extensions.joomla.org/extensions/communication/forum/12652
|180610
|
|-
|style="background:red; color:white" |

== Gallery XML 1.1 ==
|Multiple Vulnerabilities
http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/12504
|180610
|
|-
|style="background:red; color:white" |

== JFaq 1.2 ==
|JFaq 1.2 Multiple Vulnerabilities
|180610
|
|-
|style="background:red; color:white" |

== Listbingo 1.3 ==
|Multiple Vulnerabilities
http://extensions.joomla.org/extensions/ads-a-affiliates/classified-ads/12062
|180610
|
|-
|style="background:red; color:white" |

== PowerMail Pro ==
|givesight.org PowerMail Pro Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

== Alpha User Points ==
|www.alphaplug.com LFI
|180610
|
|-
|style="background:red; color:white" |

== Magic Updater ==
|http://software.realtyna.com/ RFI
|170610
|
|-
|style="background:red; color:white" |

== recruitmentmanager ==
|http://recruitment.focusdev.co.uk Upload Vulnerability
|130610
|
|-
|style="background:red; color:white" |

== Info Line (MT_ILine) ==
|http://extensions.joomla.org/extensions/news-display/news-tickers-a-scrollers/8425 reports of shell scripts in download file
|120610
|
|-
|style="background:red; color:white" |

== Search Log ==
|http://www.kanich.net/radio/site/searchlog/searchlog-download SQLi
|080610
|

|-
|style="background:red; color:white" |

== iJoobi ==
|Numerous reports under investigation, please contact [www.ijoobi.com]for more information.jtickets, jsubscription SQL Injection Vulnerability,
jstore SQL Injection Vulnerability, jnewsletter SQL Injection, jmarket SQL Injection Vulnerability, jcommunity SQL Injection, jsubscription SQL Injection,
|090610
|

|-
|style="background:red; color:white" |

== Ads manager Annonce ==
|http://joomla.clubnautiquemarine.fr/
Upload Vulnerability
| 05/06/10
|
|-
|style="background:red; color:white" |

== lead article ==
|http://www.leadya.co.il/ SQLi
|050610
|
|-
|style="background:red; color:white" |

== Search Log ==
|http://www.kanich.net search log sqli
|050610
|
|-
|style="background:red; color:white" |

== djartgallery ==
|http://www.design-joomla.eu Multiple Vul
|05/06/10
|
|-
|style="background:red; color:white" |

== Gallery 2 Bridge ==
|[http://trac.4theweb.nl/g2bridge g2bridge] LFI vulnerability
|

|-
|style="background:red; color:white" |

== jsjobs ==
|[http://www.joomsky.com jsjobs] SQL Injection Vulnerability
|
|
|-
|

== ==
|
|
|
|-
|style="background:red; color:white" |

== JE Poll ==
|http://slideshow.joomlaextensions.co.in/ SQL Injection Vulnerability
|
|
|-
|style="background:red; color:white" |

== MyCar ==
|http://www.unisoft.me/extensions/ sqli ID
|
|
|-
|style="background:red; color:white" |

== MediQnA ==
|MediQnA LFI vulnerability version : v1.1
|
|
|-
|style="background:red; color:white" |

== JE Job ==
|http://joomlaextensions.co.in/ LFI SQLi
|
|
|-
|style="background:#cef2e0; color:black"|

== BF Quiz ==
|SQL Injection Exploit Version(s) = 1.3.0
|
|[http://www.tamlyncreative.com.au/software/forum/index.php?topic=729.0 Developer update to BF Quiz v1.3.1]
|-
|

== ==
|
|
|
|-
|style="background:#cef2e0; color:black"|

== Ozio Gallery 2 ==
|DT and open email relay
|280510
|[http://oziogallery.joomla.it/index.php?option=com_content&view=article&id=65:rilasciata-la-versione-ozio-gallery-25&catid=2:notizie&Itemid=13&lang=en Developer update and security release] 010610
|-
|style="background:red; color:white" |

== SectionEx ==
|Stack Ideas section Ex LFI
|
|
|-
|style="background:red; color:white" |

== ActiveHelper LiveHelp ==
|XSS in [http://extensions.joomla.org/extensions/communication/chat/12492 LiveHelp]
|200510
|
|-
|style="background:#cef2e0; color:black"|
== RS Comments ==
|XSS Vulnerability
|
|[http://www.rsjoomla.com/customer-support/documentations/96--general-overview-of-the-component/393-changelog.html - fix posted 210510]
|-
|style="background:red; color:white" |

== BCA RSS Feed ==
|LFI and other vulnerabilities
|
|Since changed its name to NinjaRss
|-
|

== SimpleDownload ==
|http://extensions.joomla.org/extensions/directory-a-documentation/downloads/10717 various exploits
|160510
|updated version (version 0.9.6)
|-
|style="background:red; color:white" |
== JE Quotation Form ==
|http://joomlaextensions.co.in/free-download/doc_download/11-je-quotation-form.html LFI
|
|
|-
|style="background:red; color:white" |

== konsultasi ==
|SQL Injection Vulnerability
|
|
|-
|style="background:red; color:white" |

== Aardvertiser ==
|Local File Inclusion Vulnerability
http://extensions.joomla.org/extensions/ads-a-affiliates/classified-ads/9454
|
|
|-
|style="background:red; color:white" |

== Seber Cart ==
|Local File Disclosure Vulnerability
|
|[http://www.sebercart.com/index.php?option=com_content&view=article&id=158 Developer Update 140510]
|-
| style="background:#cef2e0; color:black"|

== FDione Form Wizard ==
|lfi vulnerability
|140510 200510
|[http://dionesoft.com Update to Dione Form Wizard (v. 1.0.4)].
|-
| style="background:#cef2e0; color:black"|

== Custom PHP Pages ==
|http://extensions.joomla.org/extensions/edition/custom-code-in-content/5057 LFI Vulnerability
|
|[http://fijiwebdesign.com Developer declares not vulnerable 140510]
|-
|style="background:red; color:white" |

== Camp26 Visitor ==
|RFI www.camp26.biz
|
|
|-
|style="background:#cef2e0; color:black"|

== iJoomla News Portal ==
|RFI SID
|
|[http://www.ijoomla.com/forum/index.php/topic,4480.0.html Update to 1.5.10]
|-
| |

== article Factory Manager ==
|RFI & Input Validation Error http://www.thefactory.ro/shop/joomla-components/article-manager.html
|may 2010
|can not reproduce and unproven, http://www.thefactory.ro
|-
|style="background:red; color:white" |

== Table JX Component ==
|http://www.toolsjx.com/ Table JX Component XSS
|060510 - update 130510
|Version: 1.5.5 considered unsafe
|-
|style="background:red; color:white" |

== JE Property ==
|JE Property Finder Upload Vulnerability
|
|
|-
|style="background:red; color:white" |

== Noticeboard ==
|Noticeboard for Joomla "controller" Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

==SmartSite ==
|SmartSite com_smartsite Local File Inclusion Vulnerability
|
|
|-
|style="background:#cef2e0; color:black" |

== ABC ==
|ABC SQL Injection Vulnerability
|
|reported as updated to JED 290410
|-
|style="background:red; color:white" |

== htmlcoderhelper graphics ==
|htmlcoderhelper graphics v1.0.6 LFI Vulnerability
|
|
|-
|style="background:red; color:white" |

== Ultimate Portfolio ==
|Ultimate Portfolio Local File Inclusion Vulnerability
|
|
|-
|style="background:#cef2e0; color:black" |

== huruhelpdesk ==
|http://www.huruhelpdesk.net sqli injection
|
|[http://www.huruhelpdesk.net/forums/8-announcements/392--sql-injection-reveals-user-md5-password-hash Reported fix]
|-
|style="background:red; color:white" |

== Archery Scores ==
| [http://lispeltuut.org/ Archery Scores (com_archeryscores) v1.0.6 LFI Vulnerability]

|210410
|
|-
|style="background:red; color:white" |

== ZiMB Manager ==
|Joomla Component ZiMB Manager Local File Inclusion Vulnerability
|210410
|
|-
|style="background:red; color:white" |

== Matamko ==
|Matamko Local File Inclusion Vulnerability
|210410
|
|-
|style="background:red; color:white" |

== Multiple Root ==
|Multiple Root Local File Inclusion Vulnerability http://joomlacomponent.inetlanka.com/
|
|
|-
|style="background:red; color:white" |

== Multiple Map ==
|Multiple Map Local File Inclusion Vulnerability joomlacomponent.inetlanka.com
|
|
|-
|style="background:red; color:white" |

== Contact Us Draw Root Map ==
|Draw Root Map Local File Inclusion Vulnerability joomlacomponent.inetlanka.com
|
|
|-
|style="background:red; color:white" |

== iF surfALERT ==
|[http://www.inertialfate.za.net/ iF surfALERT] Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

== GBU FACEBOOK ==
|GBU FACEBOOK SQL injection vulnerability http://www.gbugrafici.nl/gbufacebook/
|
|
|-
|style="background:red; color:white" |

== jnewspaper ==
|jnewspaper (cid) SQL Injection Vulnerability
|
|
|-
|style="background:#cef2e0; color:black"|

== JTM Reseller ==
|TM Reseller SQL injection vulnerability
|
|[http://jtmreseller.com/ Developer Update]
|-
|style="background:#cef2e0; color:black" |

== media Mall Factory ==
|SQLi
|200410
| [http://www.thefactory.ro/contact-us/product-update-request.html Solution: update to 1.0.5]

|-
|style="background:#cef2e0; color:black"|

== Gadget Factory ==
|LFi
|200410
|[http://www.thefactory.ro/contact-us/product-update-request.html Solution: update to 1.5.1]
|-
|style="background:#cef2e0; color:black"|

== Deluxe Blog Factory ==
|SQLi
|200410
|[http://www.thefactory.ro/contact-us/product-update-request.html update to 1.1.2]
|-
|

== ==
|
|
|-
|style="background:red; color:white" |
== MT Fire Eagle ==

|LFI http://joomlacode.org/gf/project/jfireeagle/frs/ http://www.moto-treks.com
| 190410
| product considered retired and to be replaced by dev
|-

|

== com properties ==
| http://com-property.com/ SQL I
|
|[http://www.com-property.com/images/fbfiles/files/properties-20100413.txt developer announced fix]
|-
|style="background:red; color:white"|

== Sweetykeeper ==
|Sweetykeeper Local File Inclusion Vulnerability http://www.joomlacorner.com/
|120410
|
|-
|style="background:red; color:white"|

== jvehicles ==
|SQL Injection http://jvehicles.com
|120410
|
|-
|style="background:red; color:white"|

== worldrates ==
|http://dev.pucit.edu.pk/
|120410
|
|-
|style="background:red; color:white"|

== cvmaker ==
|http://dev.pucit.edu.pk/
|
|
|-
|style="background:red; color:white"|

== advertising ==
|http://dev.pucit.edu.pk/
|
|
|-
|style="background:red; color:white"|

== horoscope ==
|http://dev.pucit.edu.pk/
|120410
|
|-
|style="background:red; color:white"|

== webtv ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:red; color:white"|

== diary ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:#cef2e0; color:black"|

== Multi-Venue Restaurant Menu Manager (MVRMM) ==
|http://www.focusdev.co.uk/
|120410
||[http://extensions.joomla.org/extensions/vertical-markets/food-a-beverage/10015 Version 1.5.2 Stable Update 4]
|-
|style="background:red; color:white"|

== Memory Book ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:red; color:white"|

== TRAVELbook ==
| http://www.demo-page.de/
|120410
|-
|style="background:#cef2e0; color:black"|

== AlphaUserPoints ==
|
|[http://www.alphaplug.com/index.php/downloads.html?func=fileinfo&id=31 developer upgrade]

|-
|style="background:red; color:white"|

== JprojectMan ==
|LFI http://extensions.joomla.org/extensions/communities-a-groupware/project-a-task-management/5676
|110410
|-
|style="background:#cef2e0; color:black"|

== CKForms ==
|1.3.4 release - Important LFI security fix [http://joomlacode.org/gf/project/ckforms/news/?action=NewsThreadView&id=2814 ]
|07-04-10
|[http://ckforms.cookex.eu/download/download.php upgrade]
|-
|style="background:red; color:white"|

== econtentsite ==
|LFI
|040410
|-
|style="background:red; color:white"|

== Jvehicles ==
|ID
|040410
|-
|

== ==
|
|
|-
|style="background:#cef2e0; color:black"|

== smestorage ==
|[http://www.smestorage.com SMEStorage] LFI

|Updated 29 March 10
|[http://gelembjuk.com/index.php?option=com_content&view=section&layout=blog&id=1&Itemid=55 developer fix] to 1.1
|-
|style="background:#cef2e0; color:black"|

== JE Tooltip ==
|[http://joomlaextensions.co.in/formcreator/ JE Tooltip] LFI
|Updated 23 March
|-
|style="background:#cef2e0; color:black"|

== Gift Exchange Beta ==
|[http://extensions.joomla.org/extensions/communities-a-groupware/membership/11680 Gift exchange] SQLi
|Updated 23 March
|[http://socialables.com/28-Jomsocial/Gift-Exchange/flypage.tpl.html upgrade beta 1.0.1]

|-
|style="background:#cef2e0; color:black"|

== RokDownloads ==
|[[http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7967 LFI]]
|15 march 2010
||upgrade to [http://www.rockettheme.com/extensions-updates/638-rokdownloads-10-released version 1.0]
|-
|style="background:red; color:white"|

== gigcalender ==

|SQLi [http://extensions.joomla.org/extensions/calendars-a-events/events/97)http://extensions.joomla.org/extensions/calendars-a-events/events/97 gigcalender]
|13 march 2010
|
|-
|style="background:red; color:white"|

== heza content ==
|SQLi [http://extensions.joomla.org/extensions/structure-a-navigation/sections-a-categories/10427)http://extensions.joomla.org/extensions/structure-a-navigation/sections-a-categories/10427 heza content]
|13 march 2010
|
|-
|style="background:red; color:white"|

== juliaportfolio ==
|LFI [http://extensions.joomla.org/extensions/directory-&-documentation/portfolio/8519/details juliaportfolio]
|13 march 2010
|
|-

|style="background:#cef2e0; color:black" |

== Flash Magazine Deluxe ==
|SQL Injection Vulnerability.
|Feb 25
|'''[http://www.joomplace.com/flash-magazine-deluxe/flash-magazine-deluxe-description.html Developer Update Version 2.0.11 09/03/10]'''
|-
|style="background:red; color:white" |

== SqlReport ==
|Sqlreport has a sql/RFI exploit. awaiting confirmation on exact developer.
|Feb 20
|'''Not Known'''
|-
|style="background:#cef2e0; color:black" |

== Scriptegrator ==
|Core Design [http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html Scriptegrator] RFI exploit
|Feb 20
|[http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html Dev Upgrade announcement]
|-
|style="background:#cef2e0; color:black" |

== AllVideos 3.1 ==
|
A vulnerability discovered in versions 3.0. and 3.1 of the plugin can be exploited by malicious people to disclose potentially sensitive information. For security reasons we will not be providing further details to safeguard users of affected versions. http://www.joomlaworks.gr/content/view/77/34/]|
|17 Feb
| [http://joomlaworks.googlecode.com/files/plg_jw_allvideos-v3.3_j1.5.zip Version 3.3 release 18th]
|-
|style="background:#cef2e0; color:black" |

== RW Cards ==
| [http://extensions.joomla.org/extensions/3430/details RW Card] LFI and ID exploit [http://www.weberr.de/ Dev Site]
|180210
|style="background:#cef2e0; color:black" |''' [http://www.weberr.de/index.php/forum.html?func=view&catid=5&id=1939&limit=6 developer update]'''
|-
|style="background:red; color:white" |

== Yelp ==
| SQLi - Unable to locate developer. Possibly a custom extension.
|Feb 01
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |

== '''Autartitarot''' ==
|Directory Traversal. Back end access required
| Feb 05
|style="background:#cef2e0; color:black" | ''' Please upgrade to [http://www.autartica.be/en/autartitarot version 1.0.4]'''
|-
|style="background:#cef2e0; color:black" |

== communitypolls ==
|LFI - [http://www.corejoomla.com/ community polls]
|Feb 17
||upgrade to [http://www.corejoomla.com/ version 1.5.3]
|-
|

== ==
|
|
|
|}
<endFeed />

''This list is change protected, for updates or additions [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
''

== Codes used ==
SQLi - SQL injection [http://en.wikipedia.org/wiki/Code_injection#SQL_injection wikipedia]

LFI - Local File Inclusion [http://www.scribd.com/doc/6498408/Remote-and-Local-File-Inclusion-Explained scribd]

RFI - Remote file inclusion [http://en.wikipedia.org/wiki/Remote_File_Inclusion wikipedia]

DT - Directory Traversal [http://en.wikipedia.org/wiki/Directory_traversal wikipedia]

ID = Information Disclosure: account information or sensitive information publicly viewable

== Future Actions & WIP ==

[http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions RSS feed] completed

to feed VEL direct to twitter

== Notes ==
The RSS feed is currently fed by item entry order and not by date fixed.
List as discussed in [[jtopic:455746]] by [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=67439 PhilD] editing by [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville]

----
[[Category:Security]]
[[Category:Security_FAQ]]

----

Archived:Vulnerable Extensions List

2010-06-03T08:44:37Z

Hidabe:

{{RightTOC}}
== Check and Report. ==

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic or the [http://forum.joomla.org/viewforum.php?f=470 extensions] topic clearly marked with the first word in the title being ''Vulnerable'' where the security moderators or JSST team will respond.
This list is change protected, for updates or editing requests [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
*If you are seeing this page on any site other than [http://docs.joomla.org/Vulnerable_Extensions_List the Offical Joomla Documentation] you may be seeing an out of date version or experiencing [http://en.wikipedia.org/wiki/Plagiarism plagiary] and the links may not work properly

== How to use this list ==
'''Items will be removed after a suitable period and not on resolution'''
All known vulnerable extensions are the listed in the first column. Any in a red box are high where we have not been given a fix for. Alert Advisory details in the centre column (the date is in American format mm/dd/yyyy).
The link to the advisory notice.
Finally a link to the notice about any update with link or '''Not Known''' where none is known.

'''This list is compiled from found information and may not be an up to date accurate list''' ''We do '''NOT''' promise to test or validate these reports. We do '''NOT''' guarantee the quality or effectiveness of any updates reported to us or listed here.''
To sign up for the feed please [http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions follow this link]

== November 2009 Compiled Vulnerability Reports. ==

Items are not in any particular order.

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''
|-
| style="background:#cef2e0; color:black" | '''com_ajaxchat'''
| Summary: PHP remote file inclusion vulnerability in Fiji Web Design Ajax Chat ('''com_ajaxchat''') component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter to tests/ajcuser.php.New version release December 22,2009
Published: october 28 2009
| [[NIST:CVE-2009-3822|CVE-2009-3822]]
| style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/communication/chat/10767 update v 1.1]
|-
| style="background:#cef2e0; color:black" | '''com_booklibrary'''
| PHP remote file inclusion vulnerability in doc/releasenote.php in the BookLibrary ('''com_booklibrary''') component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter, a different vector than [[NIST:CVE-2009-2637|CVE-2009-2637]]. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 10/28/2009
CVSS Severity: 7.5 (HIGH)
| [[NIST:CVE-2009-3817|CVE-2009-3817]]
| style="background:#cef2e0; color:black" | '''[http://ordasoft.com/Download/Joomla1.0-extensions/Joomla1.0-components/View-category.html developer site updates]'''
|-
| style="background:#cef2e0; color:black" | '''com_foobla_suggestions'''
| Summary: SQL injection vulnerability in the foobla Suggestions ('''com_foobla_suggestions''') component 1.5.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the idea_id parameter to index.php.
Published: 10/11/2009
CVSS Severity: 7.5 (HIGH)
| [[NIST:CVE-2009-3669|CVE-2009-3669]]
| style="background:#cef2e0; color:white" | [http://foobla.com/news/latest/fixed-foobla-suggestions-for-joomla-idea_id-sql-injection-vulnerability.html developer reported upgrade]
|-
| style="background:red; color:white" | '''com_djcatalog'''
| Summary: Multiple SQL injection vulnerabilities in the DJ-Catalog ('''com_djcatalog''') component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a showItem action and (2) cid parameter in a show action to index.php.
Published: 10/11/2009
CVSS Severity: 6.8 (MEDIUM)
| [[NIST:CVE-2009-3661|CVE-2009-3661]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_cbresumebuilder'''
| Summary: SQL injection vulnerability in the JoomlaCache CB Resume Builder (''''''com_cbresumebuilder''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a group_members action to index.php.
Published: 10/09/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3645|CVE-2009-3645]]
| style="background:#cef2e0; color:white" |'''[http://www.joomlacache.com/commercial-extensions/security-update.html Developer Update]'''
|-
| style="background:red; color:white" | '''com_soundset'''
| Summary: SQL injection vulnerability in the Soundset ('''com_soundset''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php.
Published: 10/09/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3644|CVE-2009-3644]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" |'''com_sportfusion'''
| Summary: SQL injection vulnerability in the Kinfusion SportFusion ('''com_sportfusion''') component 0.2.2 through 0.2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a teamdetail action to index.php.
Published: 09/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3491|CVE-2009-3491]]
| style="background:red; color:white" |'''Not Known'''
|-
| style="background:red; color:white" | '''com_icrmbasic'''
| Summary: A certain interface in the iCRM Basic ('''com_icrmbasic''') component 1.4.2.31 for Joomla! does not require administrative authentication, which has unspecified impact and remote attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 09/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3481|CVE-2009-3481]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_mytube'''
| Summary: SQL injection vulnerability in the MyRemote Video Gallery ('''com_mytube''') component 1.0 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter in a videos action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3446|CVE-2009-3446]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_fastball'''
| Summary: SQL injection vulnerability in the Fastball ('''com_fastball''') component 1.1.0 through 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the league parameter to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3443|CVE-2009-3443]]
| style="background:#cef2e0; color:white" | [http://www.fastballproductions.com latest version] 1.2.1
|-
| style="background:red; color:white" | '''com_facebook'''
| Summary: SQL injection vulnerability in the JoomlaFacebook ('''com_facebook''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a student action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3438|CVE-2009-3438]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_tupinambis'''
| Summary: SQL injection vulnerability in the Tupinambis ('''com_tupinambis''') component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the proyecto parameter in a verproyecto action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3434|CVE-2009-3434]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''com_idoblog'''
| Summary: SQL injection vulnerability in the IDoBlog ('''com_idoblog''') component 1.1 build 30 for Joomla! allows remote attackers to execute arbitrary SQL commands via the userid parameter in a profile action to index.php, a different vector than [[NIST:CVE-2008-2627|CVE-2008-2627]].
Published: 09/25/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3417|CVE-2009-3417]]
| style="background:#cef2e0; color:white" |'''[http://idojoomla.com/download.html/ '''New Version v 1.1''' (build 32)]'''
|-
| style="background:red; color:white" | '''com_hbssearch'''
| Summary: Cross-site scripting ('''XSS''') vulnerability in the Hotel Booking Reservation System ('''aka HBS or com_hbssearch''') component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the adult parameter in a showhoteldetails action to index.php.
Published: 09/24/2009
CVSS Severity: 4.3 ('''MEDIUM''')
| [[NIST:CVE-2009-3368|CVE-2009-3368]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_hbssearch'''
| Summary: Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System ('''aka HBS or com_hbssearch''') component for Joomla! allow remote attackers to execute arbitrary SQL commands via the ('''1''') h_id, ('''2''') id, and ('''3''') rid parameters to longDesc.php, and the h_id parameter to ('''4''') detail.php, ('''5''') detail1.php, ('''6''') detail2.php, ('''7''') detail3.php, ('''8''') detail4.php, ('''9''') detail5.php, ('''10''') detail6.php, ('''11''') detail7.php, and ('''12''') detail8.php, different vectors than [[NIST:CVE-2008-5865|CVE-2008-5865]], [[NIST:CVE-2008-5874|CVE-2008-5874]], and [[NIST:CVE-2008-5875|CVE-2008-5875]].
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3357|CVE-2009-3357]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''com_alphauserpoints'''
| Summary: SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints ('''com_alphauserpoints''') component 1.5.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the username2points parameter.
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3342|CVE-2009-3342]]
| style="background:#cef2e0; color:white" |'''[http://www.alphaplug.com/index.php/news/142-alphauserpoints-153-released.html 1.5.3]'''
|-
| style="background:red; color:white" | '''TurtuShout'''
| Summary: SQL injection vulnerability in the TurtuShout component 0.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Name field.
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3335|CVE-2009-3335]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_jinc'''
| Summary: SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component ('''aka JINC or com_jinc''') component 0.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a messages action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3334|CVE-2009-3334]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_jbudgetsmagic'''
| Summary: SQL injection vulnerability in the JBudgetsMagic ('''com_jbudgetsmagic''') component 0.3.2 through 0.4.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the bid parameter in a mybudget action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3332|CVE-2009-3332]]
| style="background:#cef2e0; color:black" | '''[http://sopinet.com/jbudgetsmagic/index.php?option=com_remository&Itemid=5&lang=en Update to 0.4.1]'''
|-
| style="background:red; color:white" | '''com_surveymanager'''
| Summary: SQL injection vulnerability in the Focusplus Developments Survey Manager ('''com_surveymanager''') component 1.5.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the stype parameter in an editsurvey action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3325|CVE-2009-3325]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_album'''
| Summary: Directory traversal vulnerability in the Roland Breedveld Album ('''com_album''') component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. ('''dot dot''') in the target parameter to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3318|CVE-2009-3318]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_jreservation'''
| Summary: SQL injection vulnerability in the [http://extensions.joomla.org/extensions/vertical-markets/booking-a-reservation/9798 JReservation] ('''com_jreservation''') component 1.0 and 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a propertycpanel action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3316|CVE-2009-3316]]
| style="background:#cef2e0; color:black" | [http://www.jforjoomla.com Updated 28th] Jan fixed 13th Nov
|-
| style="background:red; color:white" | '''IXXO Cart Standalone'''
| Summary: SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, and the IXXO Cart component for Joomla! 1.0.x, allows remote attackers to execute arbitrary SQL commands via the parent parameter.
Published: 09/16/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3215|CVE-2009-3215]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_digifolio'''
| Summary: SQL injection vulnerability in the DigiFolio ('''com_digifolio''') component 1.52 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a project action to index.php.
Published: 09/15/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3193|CVE-2009-3193]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_aclassf'''
| Summary: Cross-site scripting ('''XSS''') vulnerability in '''gmap.php''' in the Almond Classifieds ('''com_aclassf''') component 7.5 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the addr parameter.
Published: 09/10/2009
CVSS Severity: 4.3 ('''MEDIUM''')
| [[NIST:CVE-2009-3155|CVE-2009-3155]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_aclassf'''
| Summary: SQL injection vulnerability in the Almond Classifieds ('''com_aclassf''') component 7.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action to index.php, a different vector than [[NIST:CVE-2009-2567|CVE-2009-2567]].
Published: 09/10/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3154|CVE-2009-3154]]
| style="background:#cef2e0; color:white" | [http://www.almondsoft.com/alcl.html Developer latest component]
|-
| style="background:red; color:white" | '''com_jabode'''
| Summary: SQL injection vulnerability in Jabode horoscope extension ('''com_jabode''') for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.
Published: 09/08/2009
CVSS Severity: 7.5 ('''HIGH''')

| [[NIST:CVE-2008-7169|CVE-2008-7169]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_gameserver'''
| Summary: SQL injection vulnerability in the Game Server ('''com_gameserver''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a gamepanel action to index.php.
Published: 09/03/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3063|CVE-2009-3063]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_artportal'''
| Summary: SQL injection vulnerability in the Artetics.com Art Portal ('''com_artportal''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the portalid parameter to index.php.
Published: 09/03/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3054|CVE-2009-3054]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_agora'''
| Summary: Directory traversal vulnerability in the Agora ('''com_agora''') component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.
Published: 09/03/2009
CVSS Severity: 6.8 ('''MEDIUM''')
| [[NIST:CVE-2009-3053|CVE-2009-3053]]
| style="background:#cef2e0; color:white" |'''[http://jvitals.com/index.php?option=com_rokdownloads&view=file&Itemid=108&id=282:agora-3-0 3.0.7]'''
|-
| style="background:red; color:white" | '''com_simpleshop'''
| Summary: SQL injection vulnerability in the Simple Shop Galore ('''com_simpleshop''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the section parameter in a section action to index.php, a different vulnerability than [[NIST:CVE-2008-2568|CVE-2008-2568]]. NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
Published: 08/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-7033|CVE-2008-7033]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_groups'''
| Summary: SQL injection vulnerability in the Permis ('''com_groups''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a list action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 08/17/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-2789|CVE-2009-2789]]
| style="background:red; color:white" | '''Not Known'''

|-
| style="background:#cef2e0; color:black" | '''com_content'''
| Summary: SQL injection vulnerability in the content component ('''com_content''') 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a blogcategory action to index.php.
Published: 08/10/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6923|CVE-2008-6923]]
| style="background:#cef2e0; color:white" |'''[http://developer.joomla.org/security/news/305-20091103-core-front-end-editor-issue-.html Resolution]'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: SQL injection vulnerability in the Live Chat ('''com_livechat''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the last parameter to getChatRoom.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6883|CVE-2008-6883]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: Live Chat ('''com_livechat''') component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6882|CVE-2008-6882]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: Multiple SQL injection vulnerabilities in the Live Chat ('''com_livechat''') component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the last parameter to ('''1''') getChat.php, ('''2''') getChatRoom.php, and ('''3''') getSavedChatRooms.php.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6881|CVE-2008-6881]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''JUMI'''
| There is a backdoor in JUMI that installs itself when JUMI is installed on your web site. It sends your credentials to a website, and sets up a back door for remote code execution.
Please remove JUMI2.0.5 immediately.
It will be simple enough to remove the compromised code from this download, but you need to do
a full security audit on your site as well as you have been compromised. Added November 2009
| [http://code.google.com/p/jumi/updates/list Report]
| style="background:#cef2e0; color:white" |[http://code.google.com/p/jumi/updates/list Jumi Update]
|-
| style="background:#cef2e0; color:black" |'''com_photoblog'''
| Input Validation Error Added November 2009
| [http://www.securityfocus.com/bid/36809/ 36809]
| style="background:#cef2e0; color:white" |[http://webguerilla.net/downloads/3-components-for-joomla-1 webguerilla Photoblog alpha 3b]
|-
| style="background:red; color:white" | '''com_jshop'''
| Summary: SQL injection vulnerability in the JShop ('''com_jshop''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a product action to index.php.
Published: 11/02/2009
CVSS Severity: 7.5 '''(HIGH)'''
| [[NIST:CVE-2009-3835|CVE-2009-3835]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''BF Survey Pro'''
| Summary: SQL injection vulnerability in the '''BF Survey Pro''' v1.2.5 or lower (fixed in version 1.2.6). '''BF Survey Basic v1.0''' (fixed in version 1.1). '''BF Quiz v1.1.1''' (fixed in version 1.2 or greater) Added November 2009
| [http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.0 tamlyncreative.com.au]
| style="background:#cef2e0; color:white" |[http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.0 update]
|-
| style="background:#cef2e0; color:black" |'''Joo!BB 0.9.1 '''
| Summary: Persistent XSS/MySQL Injection vulnerabilities in Joo!BB 0.9.1 Added November 2009
| [http://www.joobb.org/community/board/topic/700-MultipleXSSSQLInjectionVulnerabilities.html joob.org]
| style="background:#cef2e0; color:white" |[http://www.joobb.org/downloads/components.html update]
|-
| style="background:#cef2e0; color:black" |'''sh404sef '''
| Summary: sh404sef URI XSS Vulnerability Added November 2009
| [http://jeffchannell.com/Joomla/sh404sef-uri-xss-vulnerability.html jeffchannell.com]
| style="background:#cef2e0; color:white" |[http://extensions.siliana.com/en/2009060876/sh404SEF-and-url-rewriting/Interim-release-of-sh404sef-for-Joomla-1.5.x.html update]
|-
| style="background:#cef2e0; color:black" | '''AWD Wall 1.5'''
| Summary '''AWD Wall 1.5''' Blind SQL Injection Vulnerability.The Joomla component AWD Wall 1.5 suffers from an SQL Injection vulnerability in its handling of the 'cbuser' parameter.Added November 2009
| [http://jeffchannell.com/Joomla/awd-wall-15-blind-sql-injection-vulnerability.html Notice]
|style="background:#cef2e0; color:white" | '''[http://www.awdsolution.com/template_demo/testsite/index.php?option=com_content&view=article&id=48&Itemid=72 developer update]'''
|-
| style="background:red; color:white" | '''EasyBook 2.0.0rc4'''
| Summary: The Joomla component '''EasyBook 2.0.0rc4''' suffers from multiple persistent XSS vulnerabilities. One seems fairly critical, while the others would take some incredible creativity to actively exploit. Added November 2009
| [http://jeffchannell.com/Joomla/easybook-200rc4-multiple-xss-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''F!BB 1.5.96'''
| Summary: The Joomla component '''F!BB 1.5.96 RC''' suffers from multiple persistent XSS vulnerabilities, as well SQL Injection in its user search feature. Added November 2009
| [http://jeffchannell.com/Joomla/fbb-1596-rc-multiple-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''Testimonial Ku 2.0 Admin Panel'''
| Summary: The Joomla component '''Testimonial Ku 2.0''' is vulnerable to persistent XSS in the administrator panel. A malicious user can submit a testimonial containing <script> tags with absolutely no quotes and inject that script into the administrator panel through any of the available inputs except "email". Added November 2009
| [http://jeffchannell.com/Joomla/testimonial-ku-20-admin-panel-persistent-xss.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''MS Comment 0.8.0b'''
| Summary '''MS Comment 0.8.0b for Joomla''', a commenting plugin, suffers from an multiple vulnerabilities. Added November 2009
| [http://jeffchannell.com/Joomla/ms-comment-080b-multiple-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:#cef2e0; color:black" | '''!JoomlaComment 4.0 beta1'''
| Summary: '''!JoomlaComment 4.0 beta1''', a commenting plugin, suffers from multiple XSS vulnerabilities. Added November 2009
| [http://jeffchannell.com/Joomla/joomlacomment-40-beta1-multiple-xss-vulnerabilities.html Alert]
| style="background:#cef2e0; color:white" | ''' [http://compojoom.com/blog/8-news/121-joomlacomment-40-rc1-released Developer Notice 4.0 rc1]''
|-
| style="background:red; color:white" | '''WebAmoeba Ticket System 3.0.0'''
| Summary: '''WebAmoeba Ticket System 3.0.0''', a Joomla help desk component. The vulnerability is with the BBCode library used to parse BBCode tags, as it does not strip javascript: urls from [url] tags. Added November 2009
| [http://jeffchannell.com/Joomla/webamoeba-ticket-system-300-bbcode-xss.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Kunena 1.5.x'''
|Summary: This is an important security release and users are urged to update immediately. Five security issues and an Internet Explorer 8 table bug have been resolved in this release. This release also contains many other important bug fixes. Added 18 November 2009
|[http://www.kunena.com/blog/19-developer-blog/51-kunena-157-security-release-now-available Advisory]
|style="background:#cef2e0; color:white" |[http://www.kunena.com/blog/19-developer-blog/52-kunena-158-service-release-now-available Latest 1.5.8 Version]
|-
| style="background:red; color:white" | '''com_siirler'''
| Summary: SQL injection vulnerability in the '''Q-Proje Siirler Bileseni (com_siirler)''' component 1.2 RC for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in an sdetay action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3972 | CVE-2009-3972]]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''jTips (com_jtips)'''
|SUmmary:SQL injection vulnerability in the '''jTips (com_jtips)''' component 1.0.7 and 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the season parameter in a ladder action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3971 |CVE-2009-3971]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''NinjaMonials'''
| Summary: SQL injection vulnerability in the '''NinjaMonials (com_ninjacentral)''' component 1.1.0 for '''Joomla 1.0.x''' ! allows remote attackers to execute arbitrary SQL commands via the testimID parameter in a display action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3964 | CVE-2009-3964]]
|style="background:#cef2e0; color:white" |''' [http://ninjaforge.com/index.php?option=com_ninjacentral&page=show_package&id=14&Itemid=235 developer patch Ver 1.2]'''
|-
|style="background:#cef2e0; color:black" | '''webee 1.1.1 &1.2'''
|Summary: '''webee 1.1.1,''' a Joomla commenting plugin, suffers from multiple vulnerabilities. '''webee has been updated to 1.2''' as of 12 November 2009 and''' still suffers''' from SQL Injection. XSS was not tested in 1.2. Added 19 November 2009
| [http://jeffchannell.com/Joomla/webee-111-multiple-vulnerabilities.html jeffchannell.com]
|style="background:#cef2e0; color:white" | ''' [http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/10155 developer update ver2.0]'''
|-
|style="background:#cef2e0; color:black" |'''iF Portfolio Nexus'''
|Summary: The '''iF Portfolio Nexus component for Joomla!''' is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements using the id parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. Nov 18, 2009
|[http://secunia.com/advisories/37408/ secunia.com 37408/]
|style="background:#cef2e0; color:white" |[http://www.inertialfate.za.net/help/forums/topic?id=10&p=3#p172 iF Portfolio Nexus v1.1.1 released]

|-
|style="background:red; color:white" | '''JoomClip'''
|Summary: The '''JoomClip component for Joomla!''' is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the index.php script using the cat parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. Nov 18, 2009
|[http://secunia.com/advisories/37400/ secunia.com 37400/]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Joomla XML'''
|Summary: Joomla! before 1.5.15 allows remote attackers to read an extension's XML file, and thereby obtain the extension's version number, via a direct request.
Published: 11/16/2009
|[[NIST:CVE-2009-3946 | CVE-2009-3946]]
|style="background:#cef2e0; color:white" |'''[http://developer.joomla.org/security/news/306-20091103-core-xml-file-read-issue.html Resolution]'''
|-
|style="background:red; color:white" | '''Mygallery Remote SQL Injection Vulnerability'''
|Summary: Joomla Component mygallery ( farbinform_krell) Remote SQL Injection Vulnerability Added 27 Nov 2009 {{JVer|1.5}} NB: This could be an error in our database as the only one we could find was for wordpress.If anyone know of one for joomla please let us know..(poss joomlicious.com CM)
|[http://www.exploit-db.com]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Extreme Google Calendar'''
|Summary: '''com_gcalendar 1.1.2''' (gcid) Remote SQL Injection Vulnerability
Remote SQL Injection were identified in Google Calendar Component [http://extensions.joomla.org/extensions/calendars-a-events/calendars/4188 Extension Link] Added 27 Nov 2009
|[http://www.exploit-db.com reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''LyftenBloggie'''
| Summary: [http://www.lyften.com/products/lyftenbloggie.html LyftenBloggie] Component "author" SQL Injection Vulnerability LyftenBloggie 1.x Added 27 Nov 2009
|[http://secunia.com/advisories/product/28005/ SA37499]
| [http://jeffchannell.com/Joomla/lyften-bloggie-sql-injection-fix.html Un official fix]. Developer fix not release at 30 Nov 09 ''' [http://www.lyften.com/products/lyftenbloggie/extensions/download/id-20.html 1.0.4a (last update on Dec 28, 2009)]'''
|-
|style="background:#cef2e0; color:black" |'''Sermon speaker'''
|Summary: [http://joomlacode.org/gf/project/sermon_speaker sermon speaker] sql vulnerability and password reset vulnerability version 3.2 and below
|
|style="background:#cef2e0; color:white" |[http://joomlacode.org/gf/project/sermon_speaker/forum/?action=ForumBrowse&forum_id=7897&_forum_action=ForumMessageBrowse&thread_id=15219 Developer fix] 30 Nov 2009
|-
|style="background:#cef2e0; color:white" | [http://joomlacode.org/gf/project/musicgallery/ MusicGallery]
|Summary: [http://joomlacode.org/gf/project/musicgallery/ Component MusicGallery] SQL Injection Vulnerability 30 November {{JVer|1.5}}
|[[NIST:CVE-2009-4217 | CVE-2009-4217]]
|style="background:#cef2e0; color:black" | [http://joomlacode.org/gf/project/musicgallery/ developer]
|}

----

== December 2009 Compiled Reports ==
{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''
|-
|style="background:red; color:white" | '''Omilen Photo Gallery'''
|Summary: Directory traversal vulnerability in the [http://extensions.joomla.org/extensions/photos-&-images/photo-flash-gallery/6373/details Omilen Photo Gallery] (com_omphotogallery) component Beta 0.5 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php.
Published: 12/04/2009
|[[NIST:CVE-2009-4202 | CVE-2009-4202]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Seminar'''
|Summary: SQL injection vulnerability in the [http://seminar.vollmar.ws/ Seminar] (com_seminar) component 1.28 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a View_seminar action to index.php.
Published: 12/04/2009
|[[NIST:CVE-2009-4200 | CVE-2009-4200]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Mambo Resident'''
|Summary: Multiple SQL injection vulnerabilities in the Mambo Resident (aka Mos Res or com_mosres) component 1.0f for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) property_uid parameter in a viewproperty action to index.php and the (2) regID parameter in a showregion action to index.php. Mambo Resident component for v4.5.2 '''may only be for 1.0.xx versions of J!'''
Published: 12/04/2009
|[[NIST:CVE-2009-4199 | CVE-2009-4199]]
|style="background:#cef2e0; color:white" |[http://www.jomres.net/ Replacement Extension 08 dec 09]
|-
|style="background:red; color:white" | '''ProofReader'''
|Summary: Multiple cross-site scripting (XSS) vulnerabilities in index.php in the ProofReader (com_proofreader) component 1.0 RC9 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in (1) 404 or (2) error pages. Published: 12/02/2009 CVSS Severity: 4.3 (MEDIUM)
| [[NIST:CVE-2009-4157 | CVE-2009-4157]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Laoneo Google Calendar GCalendar'''
|Summary: SQL injection vulnerability in the [http://g4j.laoneo.net/content/extensions/download/cat_view/20-joomla-15x/21-gcalendar.html Google Calendar GCalendar] (com_gcalendar) component 1.1.2, 2.1.4, and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the gcid parameter. NOTE: some of these details are obtained from third party information. Published: 11/29/2009 CVSS Severity: 7.5 (HIGH) Note: There is already a listing for GCalendar 1.1.2
|[[NIST:CVE-2009-4099 | CVE-2009-4099]]
|style="background:#cef2e0; color:white" | [http://g4j.laoneo.net/content/extensions/download/doc_details/28-gcalendar-suite-215.html Latest version GCalendar Suite 2.1.5]
|-
|style="background:red; color:white" | '''D4J eZine'''
|Summary: PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS mosConfig_absolute_path parameter. Published: 11/29/2009 CVSS Severity: 7.5 (HIGH)
|[[NIST:CVE-2009-4094 | CVE-2009-4094]]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''Quick News'''
| Summary: The Joomla [http://joomlacode.org/gf/project/quicknews/ Quick News component] suffers from a remote SQL injection vulnerability. added 1st Dec 09
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Joaktree component'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/genealogy/9842 Joaktree] Vulnerability : SQL injection/ added 1st Dec 09
|[http://securityreason.com/exploitalert/7508 7508]
|style="background:#cef2e0; color:white" | ''' [http://naastniels.nl/index.php/en/joaktree/downloads version 1.1 update]'''
|-
|style="background:red; color:white" | '''mojoblog'''
|Summary [http://www.joomlify.com/files/mojoblog/ MojoBlog] Multiple Remote File Include Vulnerability added 1st Dec 09 {{JVer|1.5}}
|[http://securityreason.com/exploitalert/7509 7509]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''YJ Whois'''
|Summary: [http://extensions.joomla.org/extensions/external-contents/domain-search/5774 YJ Whois] '''Low security risk''',and fixesMalicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. Files affected is , modules/mod_yj_whois.php added 3 December 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" |[http://www.youjoomla.com/xss-security-patch-for-yj-whois.html Developer Notice and fix 03 dec 09]
|-
|style="background:#cef2e0; color:black" | '''yt_color YOOOtheme'''
|Summary: [http://www.yootheme.com/ YT_color yootheme] Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. added 5 dec 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.yootheme.com/member-area/downloads/item/templates-15/xss-and-php-53-patches All members without an active membership can download the template patches here].'''
|-
|style="background:red; color:white" | '''TP Whois'''
|summary: [http://www.templateplazza.com/view-details/tpwhois/183-component-tp-whois-for-joomla-1.5.x.html TP Whois ] Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. Added 3 december {{JVer|1.5}}
|[http://www.exploit-db.com Refrence]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_job'''
|Summary: Component com_job ( showMoreUse) SQL injection vulnerability Added 9th Dec
|[http://xforce.iss.net/xforce/xfdb/54626 Reference]
| style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''JQuarks'''
|Summary: [http://extensions.joomla.org/extensions/contacts-and-feedback/quiz-a-surveys/10590 JQuarks] SQL injection vulnerability {{JVer|1.5}} added 8th dec 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | [http://www.iptechinside.com/labs/projects/list_files/jquarks Developer Update ]
|-
|style="background:red; color:white" | '''Mamboleto Component 2.0 RC3'''
|Summary: [http://www.fernandosoares.com.br/index.php?option=com_docman&task=cat_view&gid=28&Itemid=28 Mamboleto Component 2.0 RC3]SQL injection vulnerability {{JVer|1.5}} added 12 December
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:#cef2e0; color:black" | ''' JS JOBS'''
|Summary [http://www.joomshark.com/index.php?option=com_content&view=article&id=4&Itemid=8 JS JOBS] Joomla Component com_jsjobs 1.0.5.6 SQL Injection Vulnerabilities {{JVer|1.5}} added 12 December
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.joomsky.com/index.php?option=com_rokdownloads&view=folder&Itemid=3&id=2:components Developer update 1.0.5.7]'''
|-
|style="background:#cef2e0; color:black" | '''corePHP JPhoto'''
|Summary: [http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10365 'corePHP' JPhoto]SQL injection vulnerability {{JVer|1.5}} added 12 December
|[http://secunia.com/advisories/37676/ Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.corephp.com/blog/uber-fast-jphoto-security-release/ Developer Upgrade]'''
|-
|style="background:#cef2e0; color:black" | '''com_virtuemart'''
|Summary: "com_virtuemart" http://virtuemart.net/ '''Version : 1.0''' Vulnerability : SQL injection added Date : 07- dec -09 {{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" |[http://virtuemart.net/ latest version]
|-
|style="background:red; color:white" | ''' Kide Shoutbox'''

|Summary: The Kide Shoutbox (com_kide) component 0.4.6 for Joomla! does not properly perform authentication, which allows remote attackers to post messages with an arbitrary account name via an insertar action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Added: December 08
|[[NIST:CVE-2009-4232 | CVE-2009-4232]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | ''' JoomPortfolio Component'''
|Summary: [http://www.joomplace.com/joomportfolio/joomportfolio.html JoomPortfolio] Input passed via the "secid" parameter to index.php (when "option" is set to "com_joomportfolio" and "task" is set to "showcat") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.The vulnerability is reported in version 1.0.0. Other versions may also be affected. Added: December 18 {{JVer|1.5}}
|[http://secunia.com/advisories/37838/ Reporting Site]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''City Portal (templates?)'''
|Summary: City Portal Blind SQL Injection Vulnerability added: 2009-12-18
|[http://www.exploit-db.com Reference] Possibly this [http://www.youjoomla.com/jclick-city-portal-joomla-template.html tempate]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Event Manager'''
|Summary: [http://www.jforjoomla.com/Joomla-Components/event-manager-15-component.html Event Manager] Blind SQL Injection Vulnerability EDB-ID: 10549
added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | com_zcalendar
|Summary: com_zcalendar Blind SQL-injection Vulnerability
EDB-ID: 10548 added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_acmisc'''
|Summary: com_acmisc SQL injection added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''com_digistore'''
|Summary: com_digistore SQL injection EDB-ID: 10546 added: 2009-12-18 {{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.ijoomla.com/ijoomla-digistore/ijoomla-digistore/ijoomla-digistore-change-log/ Update change log] '''
|-
|style="background:red; color:white" | '''com_jbook'''
|Summary: com_jbook Blind SQL-injection EDB-ID: 10545 added: 2009-12-18 {{JVer|1.0}}
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_personel'''
|Summary: com_personel component for Joomla! is vulnerable to SQL injection.
|[http://xforce.iss.net/xforce/xfdb/54903 iss.net reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''JEEMA Article Collection'''
|Summary: [http://www.forum.jeema.net/component/content/article/4-jeema-article-collection-component/13-about-jeema-article-collection.html JEEMA Article Collection] Input passed via the "catid" parameter to index.php (when "option" is set to "com_jeemaarticlecollection" and "view" is set to "longlook") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. version 1.0.0.1 {{JVer|1.5}} added 22 dec 09
| [http://secunia.com/advisories/37865/ secunia]
|style="background:#cef2e0; color:white" | [http://www.jeema.net/downloads/free-joomla-extensions/joomla-components/12-jeema-joomla-article-collection.htm fixed the same in the version v102.]
|-
|style="background:red; color:white" | '''HotBrackets Tournament Brackets '''
|Summary: The [http://extensions.joomla.org/extensions/sports-a-games/sports/10746 HotBrackets Tournament Brackets] component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. {{JVer|1.5}} added 22 dec
|[http://www.securityfocus.com/bid/37439/ Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Car Manager'''
|Summary: http://webformatique.com/ com_carman Cross Site Scripting Vulnerability added 24 december 09{{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" |'''Schools component'''
|Summary: The 'com_schools' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|[http://www.securityfocus.com/bid/37469 Reference] added 24 dec 09
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''webcamxp'''
|[http://extensions.joomla.org/extensions/communication/video-conference/4490 com_webcamxp] Cross Site Scripting Vulnerabilities Last version 2008 {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''beeheard'''
|[http://extensions.joomla.org/extensions/contacts-and-feedback/testimonials-a-suggestions/10283 beeheard] Blind SQL injection Vulnerability {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://beeheard.cmstactics.com/change-log Version 1.4.2] 04 Jan'''
|-
|style="background:red; color:white" | '''jm-recommend'''
|jm-recommendCross Site Scripting Vulnerabilities. unable to locate on jed. {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | facileforms
| com_facileforms Cross Site Scripting Vulnerabilities. unable to locate on jed. Product considered retired. {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''adagency'''
| [http://www.ijoomla.com/ijoomla-ad-agency/ijoomla-ad-agency/index/ adagency ]Vulnerabilities {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_intuit'''
|[http://www.san-diego-web-designer.com/new-file-download/item/root/aboutimage-igateway-for-joomla.html com_intuit]Local File Inclusion Vulnerability {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.securityfocus.com/bid/37494/discuss Retired]'''
|-
|style="background:red; color:white" | '''MemoryBook'''
|[http://extensions.joomla.org/extensions/calendars-a-events/birthdays-a-historic-events/10868 MemoryBook 1.2] Multiple Vulnerabilities. requires: magic quotes OFF, user account {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''qpersonel'''
|[http://extensions.joomla.org/extensions/directory-a-documentation/thematic-directory/7049 qpersonel ] Cross Site Scripting Vulnerabilities {{JVer|1.0}}[[Image:http://extensions.joomla.org/images/jed/compat_15_legacy.png]] Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''opryknings point'''
|com_oprykningspoint_mc Cross Site Scripting Vulnerabilities {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''trabalhe conosco'''
|com_trabalhe_conosco Cross Site Scripting Vulnerabilities {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''DhForum'''
|com_dhforum SQL Injection Vulnerability. considered retired/EOL Dec. 27 {{JVer|1.0}}1.5 legacy
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''com_morfeoshow'''
|[http://extensions.joomla.org/extensions/photos-a-images/photo-gallery-add-ons/9810 morfeoshow] this was a false report
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:black" | ''' false report'''
|-
|style="background:#cef2e0; color:black" |'''Run Digital Download rd-download'''
|[http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7838 RD Download] Local File Disclosure Vulnerability {{JVer|1.5}} Dec. 30 Version affected not disclosed.
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7838 Version 0.9 relased]
|-
|
|
|
|
|}

----

== January 2010 Reported Vulnerable Extensions ==

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic or the [http://forum.joomla.org/viewforum.php?f=470 extensions] topic clearly marked with the first word in the title being ''Vulnerable'' where the security moderators or JSST team will respond.
''This list is change protected, for updates or editing requests [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
''

[http://docs.joomla.org/Vulnerable_Extensions_List Back To Top]

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''

|-
|style="background:#cef2e0; color:black" |JvideoDirect
|Summary: [http://extensions.joomla.org/extensions/multimedia/video-players-a-gallery/9501 Jvideodirect] SQLi Jan 29
|
|http://www.jvideodirect.com/ Update version 2.5
|style="background:red; color:white" | ''' '''
|-
|style="background:#cef2e0; color:black" |'''JEvent search plugin'''
|Summary: JEvent search plugin for [http://extensions.joomla.org/extensions/calendars-a-events/events/95 JEvent] SQLi reported Jan 29
|
|style="background:#cef2e0; color:white" | ''' [http://www.jevents.net/forum/viewtopic.php?f=17&t=3910#p15526 upgrade to 1.5.3b]'''
|
|-
|style="background:#cef2e0; color:black" |'''Kunena'''
|Summary: [http://extensions.joomla.org/extensions/communication/forum/7256/details kunena] re reported suffering SQLi in version 1.5.9 Jan 29 Confirmation Required '''Now found to be malicious'''
|
|style="background:#cef2e0; color:black" | ''' [http://www.kunena.com/blog/19-developer-blog/51-kunena-157-security-release-now-available Versions 1.5.5 and below only]'''
|
|-
|style="background:red; color:white" |'''JE Quiz'''
|Summary : http://extensions.joomla.org/extensions/contacts-and-feedback/quiz-a-surveys/11212 JeQuiz SQLi reported 29 Jan
|
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black"" |'''idoblog'''
|summary: exploitable due to open file permissions. 28 Jan
|Private Notification
|style="background:#cef2e0; color:black" | ''' [http://idojoomla.com/news.html build 35 released] '''
|-
|style="background:#cef2e0; color:black" |'''ccnewsletter'''
|Summary [http://extensions.joomla.org/extensions/5112/details ccnewsletter Directory Traversal Vulnerability] Jan 28
|Private Notification
|style="background:#cef2e0; color:white" | ''' [http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html version 1.0.6 released 29 Jan]'''
|-
|style="background:#cef2e0; color:white" |'''Virtuemart 1.1.4'''
|Summary: [http://extensions.joomla.org/extensions/e-commerce/shopping-cart/129 virtuemart] Input var order_status_id is vulnerable to SQLi NB Requires Higher Level access before exploiting. Jan 27
|
|style="background:#cef2e0; color:black" | ''' [http://forum.joomla.org/viewtopic.php?p=2027005#p2027005 developer patches]'''
|-
|style="background:#cef2e0; color:black" |'''JBDiary'''
|Summary: [http://extensions.joomla.org/extensions/calendars-a-events/events/11009 JBDiary] BLIND SQL Injection Vulnerabilities Jan 24 [http://www.jb-soft.nl/ http://www.jb-soft.nl/]
|
|style="background:#cef2e0; color:white" | ''' [http://www.jb-soft.nl/index.php?option=com_content&view=article&id=64 Developer Update 27 Jan]'''
|-
|style="background:#cef2e0; color:black" |'''JbPublishDownFp'''
|Sumary: [http://extensions.joomla.org/extensions/news-production/timed-content/6496 JbPublishDownFp] SQL Injection Vulnerability Jan 24 [http://www.jb-soft.nl http://www.jb-soft.nl]
|
|style="background:#cef2e0; color:white" |''' [http://www.jb-soft.nl/index.php?option=com_content&view=article&id=64 Developer Update Jan 27]'''
|-
|style="background:red; color:white" |'''com_casino'''
|Summary: [http://extensions.joomla.org/extensions/sports-a-games/tips-a-betts com_casino]
SQL Injection Vulnerabilities Jan24
|
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Mochigames'''
|Summary: [http://extensions.joomla.org/extensions/search/mochigames com_Mochigames]
SQL Injection Vulnerabilities Jan24
|
|style="background:#cef2e0; color:white" | ''' [http://www.yoflash.com/download.html mochigames_alpha052 Released]'''
|-
|style="background:red; color:white" |'''ContentBlogList'''
|Summary: [http://extensions.joomla.org/extensions/news-production/blog/10989 com_ContentBlogList] SQL Injection Vulnerability Jan 23
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |MailChimp for Joomla 1.5
|Summary: [http://extensions.joomla.org/extensions/bridges/mailing-a-newsletter-bridges/7836 MailChimp for Joomla 1.5] jan 17
|Developer Statement
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''JoomlaXML'''
|Summary: [http://extensions.joomla.org/extensions/tools/design-tools/5020 JoomlaXML] malicious code insertion
|
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''JVClouds3D SWF module'''
|[http://joomlapro.ru/3djvclouds JVClouds3D SWF module] Cross Site Scripting . jan 14
|[http://xforce.iss.net/xforce/xfdb/55535 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''JVClouds3D'''
|[http://joomlapro.ru/3djvclouds JVClouds3D module] Cross Site Scripting . jan 14
|[http://xforce.iss.net/xforce/xfdb/55534 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''JA Showcase'''
|[http://www.joomlart.com/addons/components_and_modules/ja_showcase.html JA Showcase component] Directory Traversal jan 14
|[http://xforce.iss.net/xforce/xfdb/55512 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''jprojects'''
|Summary: Unknown Author com_j-projects Blind SQL Injection Vulnerability. Jan 10 detail update
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''jEmbed-Embed Anything'''
|[http://www.joshprakash.com/index.php?option=com_docman&task=doc_details&gid=70 jEmbed-Embed Anything] A vulnerability has been discovered in the jEmbed-Embed Anything component for Joomla, which can be exploited by malicious people to conduct SQL injection attacks. Jan 10
|[http://secunia.com/advisories/38112 Secunia Advisory: SA38112]
|style="background:red; color:white" | [http://extensions.joomla.org/extensions/3699/details Product considered retired]
|-
|style="background:#cef2e0; color:black" |'''perchagallery '''
|Summary: perchagallery [http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10350 com_perchagallery] SQL Injection Vulnerability Jan 7
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.percha.com/index.php?option=com_phocadownload&view=file&id=22:1.5&Itemid=20 Developer Update 1.5b]'''
|-
|style="background:#cef2e0; color:black" | '''CARTwebERP'''
|Summary: [http://extensions.joomla.org/extensions/bridges/e-commerce-bridges/8753 CARTwebERP] Local File Inclusion Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://extensions.joomla.org/extensions/bridges/e-commerce-bridges/8753 1.56.76 (last update on Jan 11, 2010)]'''
|-
|style="background:#cef2e0; color:black" | '''JoomlaBibleStudy'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/religion/3461 JoomlaBibleStudy] LFI Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | '''[http://joomlabiblestudy.org/invisible-downloads/category/3-component.html Developer reported update]'''
|-
|style="background:#cef2e0; color:black" | '''com_bfsurvey_basic and pro'''
|Summary: [http://www.tamlyncreative.com.au/software/ BFsurvey] SQL Injection Vulnerability ,LFI Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.tamlyncreative.com.au/software/forum/index.php?topic=641.0 Developer Update announcement]'''
|-
|style="background:red; color:white" | '''Alfresco'''
|Summary: SQL Injection Vulnerability. Not believed to be Joomlatools extension Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''abbrev'''
|Summary: [http://extensions.joomla.org/extensions/directory-a-documentation/glossary-a-dictionary/4965 abbrev] Local File Inclusion Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''countries'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/development/6553 countries] SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Dedicated Component com_tpjobs'''
|Summary: [http://www.templateplazza.com/ tpjobs] SQL Injection Vulnerability unable to locate files probably template plaza Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.templateplazza.com/extensions-updates/tpjobs-component-update-v-1.1.html Developer Update] '''
|-
|style="background:red; color:white" | '''Component com_doqment'''
|SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Component com_otzivi'''
|Blind SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''aprice'''
|Summary: [http://adeptweb.info/component/option,com_aprice/Itemid,109/ com_aprice] Component 'analog' Parameter SQL Injection Vulnerability
|[http://www.securityfocus.com/bid/37575 Report]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''cartikads'''
|Summary: [http://www.cartikahosting.com com_cartikads] Remote File Upload Vulnerability
'''Mambo''' Open Source ads management component
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Docman seller'''
|Summary: [http://extensions.joomla.org/extensions/e-commerce/subscriptions/5000 Document seller] Input passed via the "id" parameter to index.php (when "option" is set to "com_dm_orders", "task" is set to "order_form", and "payment_method" is set to "Paypal") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
|[http://secunia.com/advisories/38024/ secunia]
|style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/e-commerce/subscriptions/5000 Updated 10th Jan]
|-
|style="background:#cef2e0; color:black" | '''ozio gallery'''
|summary: [http://extensions.joomla.org/extensions/photos-a-images/photo-flash-gallery/4883 Ozio Gallery2] SQLi eploit
|[http://www.viruslist.com/en/advisories/37974 Reference]
|style="background:#cef2e0; color:white" |[http://oziogallery.joomla.it/index.php?option=com_content&view=article&id=62%3Anuova-ozio-gallery-23-aggiornamento-di-sicurezza&catid=2%3Anotizie&Itemid=13&lang=en developer update Jan 11]
|-
|style="background:#cef2e0; color:black" | '''RD-Autos Free'''
|[http://extensions.joomla.org/extensions/vertical-markets/vehicles/5458 RD-Autos Free ] This version is now commercial not free
|Private advisory to JED Jan 11
|style="background:red; color:white" | ''' Product Retired and replaced'''
|-
|style="background:red; color:white" | '''DailyMeals'''
|Summary: [http://extensions.joomla.org/extensions/vertical-markets/food-a-beverage/4764 dailymeals] Local File Inclusion Vulnerability Jan 02
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''RD-Autos Pro'''
|[http://extensions.joomla.org/extensions/vertical-markets/vehicles/6357 RD Autos Pro]
|Private advisory to JED Jan 11
|style="background:#cef2e0; color:black" | ''' Upgrade to Latest version be 2.0.2'''
|-
|
|
|
|
|}

== New format Feed Starts Here ==
Please do not change your [http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions feed url], only the feed format has changed.

== February, March, April, May 2010 Reported Vulnerable Extensions ==
<startFeed />

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic clearly marked with the first word in the title being ''Vulnerable Report'' where the security moderators or JSST team will respond. For a guide to the [http://docs.joomla.org/Vulnerable_Extensions_List_0210#Codes_used codes]

[http://docs.joomla.org/Vulnerable_Extensions_List Previous Reports]

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Date Added'''
! class="unsortable" |'''Extension Update Link & Date'''
|-
|style="background:red; color:white" |

== JE Poll ==
|http://slideshow.joomlaextensions.co.in/ SQL Injection Vulnerability
|
|
|-
|style="background:red; color:white" |

== MyCar ==
|http://www.unisoft.me/extensions/ sqli ID
|
|
|-
|style="background:red; color:white" |

== MediQnA ==
|MediQnA LFI vulnerability version : v1.1
|
|
|-
|style="background:red; color:white" |

== JE Job ==
|http://joomlaextensions.co.in/ LFI SQLi
|
|
|-
|style="background:#cef2e0; color:black"|

== BF Quiz ==
|SQL Injection Exploit Version(s) = 1.3.0
|
|[http://www.tamlyncreative.com.au/software/forum/index.php?topic=729.0 Developer update to BF Quiz v1.3.1]
|-
|

== ==
|
|
|
|-
|style="background:#cef2e0; color:black"|

== Ozio Gallery 2 ==
|DT and open email relay
|280510
|[http://oziogallery.joomla.it/index.php?option=com_content&view=article&id=65:rilasciata-la-versione-ozio-gallery-25&catid=2:notizie&Itemid=13&lang=en Developer update and security release] 010610
|-
|style="background:red; color:white" |

== SectionEx ==
|Stack Ideas section Ex LFI
|
|
|-
|style="background:red; color:white" |

== ActiveHelper LiveHelp ==
|XSS in [http://extensions.joomla.org/extensions/communication/chat/12492 LiveHelp]
|200510
|
|-
|style="background:#cef2e0; color:black"|
== RS Comments ==
|XSS Vulnerability
|
|http://www.rsjoomla.com/customer-support/documentations/96--general-overview-of-the-component/393-changelog.html - fix posted 210510
|-
|style="background:red; color:white" |

== BCA RSS Feed ==
|LFI and other vulnerabilities
|
|Since changed its name to NinjaRss
|-
|

== SimpleDownload ==
|http://extensions.joomla.org/extensions/directory-a-documentation/downloads/10717 various exploits
|160510
|updated version (version 0.9.6)
|-
|style="background:red; color:white" |
== JE Quotation Form ==
|http://joomlaextensions.co.in/free-download/doc_download/11-je-quotation-form.html LFI
|
|
|-
|style="background:red; color:white" |

== konsultasi ==
|SQL Injection Vulnerability
|
|
|-
|style="background:red; color:white" |

== Aardvertiser ==
|Local File Inclusion Vulnerability
http://extensions.joomla.org/extensions/ads-a-affiliates/classified-ads/9454
|
|
|-
|style="background:red; color:white" |

== Seber Cart ==
|Local File Disclosure Vulnerability
|
|[http://www.sebercart.com/index.php?option=com_content&view=article&id=158 Developer Update 140510]
|-
| style="background:#cef2e0; color:black"|

== FDione Form Wizard ==
|lfi vulnerability
|140510 200510
|[dionesoft.com Update to Dione Form Wizard (v. 1.0.4)].
|-
| style="background:#cef2e0; color:black"|

== Custom PHP Pages ==
|http://extensions.joomla.org/extensions/edition/custom-code-in-content/5057 LFI Vulnerability
|
|[fijiwebdesign.com Developer declares not vulnerable 140510]
|-
|style="background:red; color:white" |

== Camp26 Visitor ==
|RFI www.camp26.biz
|
|
|-
|style="background:#cef2e0; color:black"|

== iJoomla News Portal ==
|RFI SID
|
|[http://www.ijoomla.com/forum/index.php/topic,4480.0.html Update to 1.5.10]
|-
| |

== article Factory Manager ==
|RFI & Input Validation Error http://www.thefactory.ro/shop/joomla-components/article-manager.html
|may 2010
|can not reproduce and unproven, http://www.thefactory.ro
|-
|style="background:red; color:white" |

== Table JX Component ==
|http://www.toolsjx.com/ Table JX Component XSS
|060510 - update 130510
|Version: 1.5.5 considered unsafe
|-
|style="background:red; color:white" |

== JE Property ==
|JE Property Finder Upload Vulnerability
|
|
|-
|style="background:red; color:white" |

== Noticeboard ==
|Noticeboard for Joomla "controller" Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

==SmartSite ==
|SmartSite com_smartsite Local File Inclusion Vulnerability
|
|
|-
|style="background:#cef2e0; color:black" |

== ABC ==
|ABC SQL Injection Vulnerability
|
|reported as updated to JED 290410
|-
|style="background:red; color:white" |

== htmlcoderhelper graphics ==
|htmlcoderhelper graphics v1.0.6 LFI Vulnerability
|
|
|-
|style="background:red; color:white" |

== Ultimate Portfolio ==
|Ultimate Portfolio Local File Inclusion Vulnerability
|
|
|-
|style="background:#cef2e0; color:black" |

== huruhelpdesk ==
|http://www.huruhelpdesk.net sqli injection
|
|[http://www.huruhelpdesk.net/forums/8-announcements/392--sql-injection-reveals-user-md5-password-hash Reported fix]
|-
|style="background:red; color:white" |

== Archery Scores ==
| [http://lispeltuut.org/ Archery Scores (com_archeryscores) v1.0.6 LFI Vulnerability]

|210410
|
|-
|style="background:red; color:white" |

== ZiMB Manager ==
|Joomla Component ZiMB Manager Local File Inclusion Vulnerability
|210410
|
|-
|style="background:red; color:white" |

== Matamko ==
|Matamko Local File Inclusion Vulnerability
|210410
|
|-
|style="background:red; color:white" |

== Multiple Root ==
|Multiple Root Local File Inclusion Vulnerability http://joomlacomponent.inetlanka.com/
|
|
|-
|style="background:red; color:white" |

== Multiple Map ==
|Multiple Map Local File Inclusion Vulnerability joomlacomponent.inetlanka.com
|
|
|-
|style="background:red; color:white" |

== Contact Us Draw Root Map ==
|Draw Root Map Local File Inclusion Vulnerability joomlacomponent.inetlanka.com
|
|
|-
|style="background:red; color:white" |

== iF surfALERT ==
|[http://www.inertialfate.za.net/ iF surfALERT] Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

== GBU FACEBOOK ==
|GBU FACEBOOK SQL injection vulnerability http://www.gbugrafici.nl/gbufacebook/
|
|
|-
|style="background:red; color:white" |

== jnewspaper ==
|jnewspaper (cid) SQL Injection Vulnerability
|
|
|-
|style="background:#cef2e0; color:black"|

== JTM Reseller ==
|TM Reseller SQL injection vulnerability
|
|[http://jtmreseller.com/ Developer Update]
|-
|style="background:#cef2e0; color:black" |

== media Mall Factory ==
|SQLi
|200410
| [http://www.thefactory.ro/contact-us/product-update-request.html Solution: update to 1.0.5]

|-
|style="background:#cef2e0; color:black"|

== Gadget Factory ==
|LFi
|200410
|[http://www.thefactory.ro/contact-us/product-update-request.html Solution: update to 1.5.1]
|-
|style="background:#cef2e0; color:black"|

== Deluxe Blog Factory ==
|SQLi
|200410
|[http://www.thefactory.ro/contact-us/product-update-request.html update to 1.1.2]
|-
|

== ==
|
|
|-
|style="background:red; color:white" |
== MT Fire Eagle ==

|LFI http://joomlacode.org/gf/project/jfireeagle/frs/ http://www.moto-treks.com
| 190410
| product considered retired and to be replaced by dev
|-

|

== com properties ==
| http://com-property.com/ SQL I
|
|[http://www.com-property.com/images/fbfiles/files/properties-20100413.txt developer announced fix]
|-
|style="background:red; color:white"|

== Sweetykeeper ==
|Sweetykeeper Local File Inclusion Vulnerability http://www.joomlacorner.com/
|120410
|
|-
|style="background:red; color:white"|

== jvehicles ==
|SQL Injection http://jvehicles.com
|120410
|
|-
|style="background:red; color:white"|

== worldrates ==
|http://dev.pucit.edu.pk/
|120410
|
|-
|style="background:red; color:white"|

== cvmaker ==
|http://dev.pucit.edu.pk/
|
|
|-
|style="background:red; color:white"|

== advertising ==
|http://dev.pucit.edu.pk/
|
|
|-
|style="background:red; color:white"|

== horoscope ==
|http://dev.pucit.edu.pk/
|120410
|
|-
|style="background:red; color:white"|

== webtv ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:red; color:white"|

== diary ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:#cef2e0; color:black"|

== Multi-Venue Restaurant Menu Manager (MVRMM) ==
|http://www.focusdev.co.uk/
|120410
||[http://extensions.joomla.org/extensions/vertical-markets/food-a-beverage/10015 Version 1.5.2 Stable Update 4]
|-
|style="background:red; color:white"|

== Memory Book ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:red; color:white"|

== TRAVELbook ==
| http://www.demo-page.de/
|120410
|-
|style="background:#cef2e0; color:black"|

== AlphaUserPoints ==
|
|[http://www.alphaplug.com/index.php/downloads.html?func=fileinfo&id=31 developer upgrade]

|-
|style="background:red; color:white"|

== JprojectMan ==
|LFI http://extensions.joomla.org/extensions/communities-a-groupware/project-a-task-management/5676
|110410
|-
|style="background:#cef2e0; color:black"|

== CKForms ==
|1.3.4 release - Important LFI security fix [http://joomlacode.org/gf/project/ckforms/news/?action=NewsThreadView&id=2814 ]
|07-04-10
|[http://ckforms.cookex.eu/download/download.php upgrade]
|-
|style="background:red; color:white"|

== econtentsite ==
|LFI
|040410
|-
|style="background:red; color:white"|

== Jvehicles ==
|ID
|040410
|-
|

== ==
|
|
|-
|style="background:#cef2e0; color:black"|

== smestorage ==
|[http://www.smestorage.com SMEStorage] LFI

|Updated 29 March 10
|[http://gelembjuk.com/index.php?option=com_content&view=section&layout=blog&id=1&Itemid=55 developer fix] to 1.1
|-
|style="background:#cef2e0; color:black"|

== JE Tooltip ==
|[http://joomlaextensions.co.in/formcreator/ JE Tooltip] LFI
|Updated 23 March
|-
|style="background:#cef2e0; color:black"|

== Gift Exchange Beta ==
|[http://extensions.joomla.org/extensions/communities-a-groupware/membership/11680 Gift exchange] SQLi
|Updated 23 March
|[http://socialables.com/28-Jomsocial/Gift-Exchange/flypage.tpl.html upgrade beta 1.0.1]

|-
|style="background:#cef2e0; color:black"|

== RokDownloads ==
|[[http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7967 LFI]]
|15 march 2010
||upgrade to [http://www.rockettheme.com/extensions-updates/638-rokdownloads-10-released version 1.0]
|-
|style="background:red; color:white"|

== gigcalender ==

|SQLi [http://extensions.joomla.org/extensions/calendars-a-events/events/97)http://extensions.joomla.org/extensions/calendars-a-events/events/97 gigcalender]
|13 march 2010
|
|-
|style="background:red; color:white"|

== heza content ==
|SQLi [http://extensions.joomla.org/extensions/structure-a-navigation/sections-a-categories/10427)http://extensions.joomla.org/extensions/structure-a-navigation/sections-a-categories/10427 heza content]
|13 march 2010
|
|-
|style="background:red; color:white"|

== juliaportfolio ==
|LFI [http://extensions.joomla.org/extensions/directory-&-documentation/portfolio/8519/details juliaportfolio]
|13 march 2010
|
|-

|style="background:#cef2e0; color:black" |

== Flash Magazine Deluxe ==
|SQL Injection Vulnerability.
|Feb 25
|'''[http://www.joomplace.com/flash-magazine-deluxe/flash-magazine-deluxe-description.html Developer Update Version 2.0.11 09/03/10]'''
|-
|style="background:red; color:white" |

== SqlReport ==
|Sqlreport has a sql/RFI exploit. awaiting confirmation on exact developer.
|Feb 20
|'''Not Known'''
|-
|style="background:#cef2e0; color:black" |

== Scriptegrator ==
|Core Design [http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html Scriptegrator] RFI exploit
|Feb 20
|[http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html Dev Upgrade announcement]
|-
|style="background:#cef2e0; color:black" |

== AllVideos 3.1 ==
|
A vulnerability discovered in versions 3.0. and 3.1 of the plugin can be exploited by malicious people to disclose potentially sensitive information. For security reasons we will not be providing further details to safeguard users of affected versions. http://www.joomlaworks.gr/content/view/77/34/]|
|17 Feb
| [http://joomlaworks.googlecode.com/files/plg_jw_allvideos-v3.3_j1.5.zip Version 3.3 release 18th]
|-
|style="background:#cef2e0; color:black" |

== RW Cards ==
| [http://extensions.joomla.org/extensions/3430/details RW Card] LFI and ID exploit [http://www.weberr.de/ Dev Site]
|180210
|style="background:#cef2e0; color:black" |''' [http://www.weberr.de/index.php/forum.html?func=view&catid=5&id=1939&limit=6 developer update]'''
|-
|style="background:red; color:white" |

== Yelp ==
| SQLi - Unable to locate developer. Possibly a custom extension.
|Feb 01
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |

== '''Autartitarot''' ==
|Directory Traversal. Back end access required
| Feb 05
|style="background:#cef2e0; color:black" | ''' Please upgrade to [http://www.autartica.be/en/autartitarot version 1.0.4]'''
|-
|style="background:#cef2e0; color:black" |

== communitypolls ==
|LFI - [http://www.corejoomla.com/ community polls]
|Feb 17
||upgrade to [http://www.corejoomla.com/ version 1.5.3]
|-
|

== ==
|
|
|
|}
<endFeed />

''This list is change protected, for updates or additions [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
''

== Codes used ==
SQLi - SQL injection [http://en.wikipedia.org/wiki/Code_injection#SQL_injection wikipedia]

LFI - Local File Inclusion [http://www.scribd.com/doc/6498408/Remote-and-Local-File-Inclusion-Explained scribd]

RFI - Remote file inclusion [http://en.wikipedia.org/wiki/Remote_File_Inclusion wikipedia]

DT - Directory Traversal [http://en.wikipedia.org/wiki/Directory_traversal wikipedia]

ID = Information Disclosure: account information or sensitive information publicly viewable

== Developers - How to get yourself removed from the VEL ==

Resolved items will be removed after a suitable period and not on resolution

Please solve the issues and:

* If JED listed
Attach the new zip file at your actual JED listing.

Change the extension version at JED listing.

Contact the JED by mail back with a notice and ask them republish your listing.

* If not JED listed.
Inform us by PM of the link to your resolution notice on your website.

== Future Actions & WIP ==

[http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions RSS feed] completed

to feed VEL direct to twitter

== Notes ==
The RSS feed is currently fed by item entry order and not by date fixed.
List as discussed in [[jtopic:455746]] by [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=67439 PhilD] editing by [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville]

----
[[Category:Security]]
[[Category:Security_FAQ]]

----

Archived:Vulnerable Extensions List

2010-06-03T08:43:31Z

Hidabe:

{{RightTOC}}
== Check and Report. ==

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic or the [http://forum.joomla.org/viewforum.php?f=470 extensions] topic clearly marked with the first word in the title being ''Vulnerable'' where the security moderators or JSST team will respond.
This list is change protected, for updates or editing requests [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
*If you are seeing this page on any site other than [http://docs.joomla.org/Vulnerable_Extensions_List the Offical Joomla Documentation] you may be seeing an out of date version or experiencing [http://en.wikipedia.org/wiki/Plagiarism plagiary] and the links may not work properly

== How to use this list ==
'''Items will be removed after a suitable period and not on resolution'''
All known vulnerable extensions are the listed in the first column. Any in a red box are high where we have not been given a fix for. Alert Advisory details in the centre column (the date is in American format mm/dd/yyyy).
The link to the advisory notice.
Finally a link to the notice about any update with link or '''Not Known''' where none is known.

'''This list is compiled from found information and may not be an up to date accurate list''' ''We do '''NOT''' promise to test or validate these reports. We do '''NOT''' guarantee the quality or effectiveness of any updates reported to us or listed here.''
To sign up for the feed please [http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions follow this link]

== November 2009 Compiled Vulnerability Reports. ==

Items are not in any particular order.

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''
|-
| style="background:#cef2e0; color:black" | '''com_ajaxchat'''
| Summary: PHP remote file inclusion vulnerability in Fiji Web Design Ajax Chat ('''com_ajaxchat''') component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter to tests/ajcuser.php.New version release December 22,2009
Published: october 28 2009
| [[NIST:CVE-2009-3822|CVE-2009-3822]]
| style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/communication/chat/10767 update v 1.1]
|-
| style="background:#cef2e0; color:black" | '''com_booklibrary'''
| PHP remote file inclusion vulnerability in doc/releasenote.php in the BookLibrary ('''com_booklibrary''') component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter, a different vector than [[NIST:CVE-2009-2637|CVE-2009-2637]]. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 10/28/2009
CVSS Severity: 7.5 (HIGH)
| [[NIST:CVE-2009-3817|CVE-2009-3817]]
| style="background:#cef2e0; color:black" | '''[http://ordasoft.com/Download/Joomla1.0-extensions/Joomla1.0-components/View-category.html developer site updates]'''
|-
| style="background:#cef2e0; color:black" | '''com_foobla_suggestions'''
| Summary: SQL injection vulnerability in the foobla Suggestions ('''com_foobla_suggestions''') component 1.5.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the idea_id parameter to index.php.
Published: 10/11/2009
CVSS Severity: 7.5 (HIGH)
| [[NIST:CVE-2009-3669|CVE-2009-3669]]
| style="background:#cef2e0; color:white" | [http://foobla.com/news/latest/fixed-foobla-suggestions-for-joomla-idea_id-sql-injection-vulnerability.html developer reported upgrade]
|-
| style="background:red; color:white" | '''com_djcatalog'''
| Summary: Multiple SQL injection vulnerabilities in the DJ-Catalog ('''com_djcatalog''') component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a showItem action and (2) cid parameter in a show action to index.php.
Published: 10/11/2009
CVSS Severity: 6.8 (MEDIUM)
| [[NIST:CVE-2009-3661|CVE-2009-3661]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_cbresumebuilder'''
| Summary: SQL injection vulnerability in the JoomlaCache CB Resume Builder (''''''com_cbresumebuilder''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a group_members action to index.php.
Published: 10/09/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3645|CVE-2009-3645]]
| style="background:#cef2e0; color:white" |'''[http://www.joomlacache.com/commercial-extensions/security-update.html Developer Update]'''
|-
| style="background:red; color:white" | '''com_soundset'''
| Summary: SQL injection vulnerability in the Soundset ('''com_soundset''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php.
Published: 10/09/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3644|CVE-2009-3644]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" |'''com_sportfusion'''
| Summary: SQL injection vulnerability in the Kinfusion SportFusion ('''com_sportfusion''') component 0.2.2 through 0.2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a teamdetail action to index.php.
Published: 09/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3491|CVE-2009-3491]]
| style="background:red; color:white" |'''Not Known'''
|-
| style="background:red; color:white" | '''com_icrmbasic'''
| Summary: A certain interface in the iCRM Basic ('''com_icrmbasic''') component 1.4.2.31 for Joomla! does not require administrative authentication, which has unspecified impact and remote attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 09/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3481|CVE-2009-3481]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_mytube'''
| Summary: SQL injection vulnerability in the MyRemote Video Gallery ('''com_mytube''') component 1.0 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter in a videos action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3446|CVE-2009-3446]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_fastball'''
| Summary: SQL injection vulnerability in the Fastball ('''com_fastball''') component 1.1.0 through 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the league parameter to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3443|CVE-2009-3443]]
| style="background:#cef2e0; color:white" | [http://www.fastballproductions.com latest version] 1.2.1
|-
| style="background:red; color:white" | '''com_facebook'''
| Summary: SQL injection vulnerability in the JoomlaFacebook ('''com_facebook''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a student action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3438|CVE-2009-3438]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_tupinambis'''
| Summary: SQL injection vulnerability in the Tupinambis ('''com_tupinambis''') component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the proyecto parameter in a verproyecto action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3434|CVE-2009-3434]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''com_idoblog'''
| Summary: SQL injection vulnerability in the IDoBlog ('''com_idoblog''') component 1.1 build 30 for Joomla! allows remote attackers to execute arbitrary SQL commands via the userid parameter in a profile action to index.php, a different vector than [[NIST:CVE-2008-2627|CVE-2008-2627]].
Published: 09/25/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3417|CVE-2009-3417]]
| style="background:#cef2e0; color:white" |'''[http://idojoomla.com/download.html/ '''New Version v 1.1''' (build 32)]'''
|-
| style="background:red; color:white" | '''com_hbssearch'''
| Summary: Cross-site scripting ('''XSS''') vulnerability in the Hotel Booking Reservation System ('''aka HBS or com_hbssearch''') component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the adult parameter in a showhoteldetails action to index.php.
Published: 09/24/2009
CVSS Severity: 4.3 ('''MEDIUM''')
| [[NIST:CVE-2009-3368|CVE-2009-3368]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_hbssearch'''
| Summary: Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System ('''aka HBS or com_hbssearch''') component for Joomla! allow remote attackers to execute arbitrary SQL commands via the ('''1''') h_id, ('''2''') id, and ('''3''') rid parameters to longDesc.php, and the h_id parameter to ('''4''') detail.php, ('''5''') detail1.php, ('''6''') detail2.php, ('''7''') detail3.php, ('''8''') detail4.php, ('''9''') detail5.php, ('''10''') detail6.php, ('''11''') detail7.php, and ('''12''') detail8.php, different vectors than [[NIST:CVE-2008-5865|CVE-2008-5865]], [[NIST:CVE-2008-5874|CVE-2008-5874]], and [[NIST:CVE-2008-5875|CVE-2008-5875]].
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3357|CVE-2009-3357]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''com_alphauserpoints'''
| Summary: SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints ('''com_alphauserpoints''') component 1.5.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the username2points parameter.
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3342|CVE-2009-3342]]
| style="background:#cef2e0; color:white" |'''[http://www.alphaplug.com/index.php/news/142-alphauserpoints-153-released.html 1.5.3]'''
|-
| style="background:red; color:white" | '''TurtuShout'''
| Summary: SQL injection vulnerability in the TurtuShout component 0.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Name field.
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3335|CVE-2009-3335]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_jinc'''
| Summary: SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component ('''aka JINC or com_jinc''') component 0.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a messages action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3334|CVE-2009-3334]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:white" | '''com_jbudgetsmagic'''
| Summary: SQL injection vulnerability in the JBudgetsMagic ('''com_jbudgetsmagic''') component 0.3.2 through 0.4.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the bid parameter in a mybudget action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3332|CVE-2009-3332]]
| style="background:#cef2e0; color:black" | '''[http://sopinet.com/jbudgetsmagic/index.php?option=com_remository&Itemid=5&lang=en Update to 0.4.1]'''
|-
| style="background:red; color:white" | '''com_surveymanager'''
| Summary: SQL injection vulnerability in the Focusplus Developments Survey Manager ('''com_surveymanager''') component 1.5.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the stype parameter in an editsurvey action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3325|CVE-2009-3325]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_album'''
| Summary: Directory traversal vulnerability in the Roland Breedveld Album ('''com_album''') component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. ('''dot dot''') in the target parameter to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3318|CVE-2009-3318]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_jreservation'''
| Summary: SQL injection vulnerability in the [http://extensions.joomla.org/extensions/vertical-markets/booking-a-reservation/9798 JReservation] ('''com_jreservation''') component 1.0 and 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a propertycpanel action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3316|CVE-2009-3316]]
| style="background:#cef2e0; color:black" | [http://www.jforjoomla.com Updated 28th] Jan fixed 13th Nov
|-
| style="background:red; color:white" | '''IXXO Cart Standalone'''
| Summary: SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, and the IXXO Cart component for Joomla! 1.0.x, allows remote attackers to execute arbitrary SQL commands via the parent parameter.
Published: 09/16/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3215|CVE-2009-3215]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_digifolio'''
| Summary: SQL injection vulnerability in the DigiFolio ('''com_digifolio''') component 1.52 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a project action to index.php.
Published: 09/15/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3193|CVE-2009-3193]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_aclassf'''
| Summary: Cross-site scripting ('''XSS''') vulnerability in '''gmap.php''' in the Almond Classifieds ('''com_aclassf''') component 7.5 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the addr parameter.
Published: 09/10/2009
CVSS Severity: 4.3 ('''MEDIUM''')
| [[NIST:CVE-2009-3155|CVE-2009-3155]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_aclassf'''
| Summary: SQL injection vulnerability in the Almond Classifieds ('''com_aclassf''') component 7.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action to index.php, a different vector than [[NIST:CVE-2009-2567|CVE-2009-2567]].
Published: 09/10/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3154|CVE-2009-3154]]
| style="background:#cef2e0; color:white" | [http://www.almondsoft.com/alcl.html Developer latest component]
|-
| style="background:red; color:white" | '''com_jabode'''
| Summary: SQL injection vulnerability in Jabode horoscope extension ('''com_jabode''') for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.
Published: 09/08/2009
CVSS Severity: 7.5 ('''HIGH''')

| [[NIST:CVE-2008-7169|CVE-2008-7169]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_gameserver'''
| Summary: SQL injection vulnerability in the Game Server ('''com_gameserver''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a gamepanel action to index.php.
Published: 09/03/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3063|CVE-2009-3063]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_artportal'''
| Summary: SQL injection vulnerability in the Artetics.com Art Portal ('''com_artportal''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the portalid parameter to index.php.
Published: 09/03/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3054|CVE-2009-3054]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_agora'''
| Summary: Directory traversal vulnerability in the Agora ('''com_agora''') component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.
Published: 09/03/2009
CVSS Severity: 6.8 ('''MEDIUM''')
| [[NIST:CVE-2009-3053|CVE-2009-3053]]
| style="background:#cef2e0; color:white" |'''[http://jvitals.com/index.php?option=com_rokdownloads&view=file&Itemid=108&id=282:agora-3-0 3.0.7]'''
|-
| style="background:red; color:white" | '''com_simpleshop'''
| Summary: SQL injection vulnerability in the Simple Shop Galore ('''com_simpleshop''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the section parameter in a section action to index.php, a different vulnerability than [[NIST:CVE-2008-2568|CVE-2008-2568]]. NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
Published: 08/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-7033|CVE-2008-7033]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_groups'''
| Summary: SQL injection vulnerability in the Permis ('''com_groups''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a list action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 08/17/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-2789|CVE-2009-2789]]
| style="background:red; color:white" | '''Not Known'''

|-
| style="background:#cef2e0; color:black" | '''com_content'''
| Summary: SQL injection vulnerability in the content component ('''com_content''') 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a blogcategory action to index.php.
Published: 08/10/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6923|CVE-2008-6923]]
| style="background:#cef2e0; color:white" |'''[http://developer.joomla.org/security/news/305-20091103-core-front-end-editor-issue-.html Resolution]'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: SQL injection vulnerability in the Live Chat ('''com_livechat''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the last parameter to getChatRoom.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6883|CVE-2008-6883]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: Live Chat ('''com_livechat''') component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6882|CVE-2008-6882]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: Multiple SQL injection vulnerabilities in the Live Chat ('''com_livechat''') component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the last parameter to ('''1''') getChat.php, ('''2''') getChatRoom.php, and ('''3''') getSavedChatRooms.php.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6881|CVE-2008-6881]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''JUMI'''
| There is a backdoor in JUMI that installs itself when JUMI is installed on your web site. It sends your credentials to a website, and sets up a back door for remote code execution.
Please remove JUMI2.0.5 immediately.
It will be simple enough to remove the compromised code from this download, but you need to do
a full security audit on your site as well as you have been compromised. Added November 2009
| [http://code.google.com/p/jumi/updates/list Report]
| style="background:#cef2e0; color:white" |[http://code.google.com/p/jumi/updates/list Jumi Update]
|-
| style="background:#cef2e0; color:black" |'''com_photoblog'''
| Input Validation Error Added November 2009
| [http://www.securityfocus.com/bid/36809/ 36809]
| style="background:#cef2e0; color:white" |[http://webguerilla.net/downloads/3-components-for-joomla-1 webguerilla Photoblog alpha 3b]
|-
| style="background:red; color:white" | '''com_jshop'''
| Summary: SQL injection vulnerability in the JShop ('''com_jshop''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a product action to index.php.
Published: 11/02/2009
CVSS Severity: 7.5 '''(HIGH)'''
| [[NIST:CVE-2009-3835|CVE-2009-3835]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''BF Survey Pro'''
| Summary: SQL injection vulnerability in the '''BF Survey Pro''' v1.2.5 or lower (fixed in version 1.2.6). '''BF Survey Basic v1.0''' (fixed in version 1.1). '''BF Quiz v1.1.1''' (fixed in version 1.2 or greater) Added November 2009
| [http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.0 tamlyncreative.com.au]
| style="background:#cef2e0; color:white" |[http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.0 update]
|-
| style="background:#cef2e0; color:black" |'''Joo!BB 0.9.1 '''
| Summary: Persistent XSS/MySQL Injection vulnerabilities in Joo!BB 0.9.1 Added November 2009
| [http://www.joobb.org/community/board/topic/700-MultipleXSSSQLInjectionVulnerabilities.html joob.org]
| style="background:#cef2e0; color:white" |[http://www.joobb.org/downloads/components.html update]
|-
| style="background:#cef2e0; color:black" |'''sh404sef '''
| Summary: sh404sef URI XSS Vulnerability Added November 2009
| [http://jeffchannell.com/Joomla/sh404sef-uri-xss-vulnerability.html jeffchannell.com]
| style="background:#cef2e0; color:white" |[http://extensions.siliana.com/en/2009060876/sh404SEF-and-url-rewriting/Interim-release-of-sh404sef-for-Joomla-1.5.x.html update]
|-
| style="background:#cef2e0; color:black" | '''AWD Wall 1.5'''
| Summary '''AWD Wall 1.5''' Blind SQL Injection Vulnerability.The Joomla component AWD Wall 1.5 suffers from an SQL Injection vulnerability in its handling of the 'cbuser' parameter.Added November 2009
| [http://jeffchannell.com/Joomla/awd-wall-15-blind-sql-injection-vulnerability.html Notice]
|style="background:#cef2e0; color:white" | '''[http://www.awdsolution.com/template_demo/testsite/index.php?option=com_content&view=article&id=48&Itemid=72 developer update]'''
|-
| style="background:red; color:white" | '''EasyBook 2.0.0rc4'''
| Summary: The Joomla component '''EasyBook 2.0.0rc4''' suffers from multiple persistent XSS vulnerabilities. One seems fairly critical, while the others would take some incredible creativity to actively exploit. Added November 2009
| [http://jeffchannell.com/Joomla/easybook-200rc4-multiple-xss-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''F!BB 1.5.96'''
| Summary: The Joomla component '''F!BB 1.5.96 RC''' suffers from multiple persistent XSS vulnerabilities, as well SQL Injection in its user search feature. Added November 2009
| [http://jeffchannell.com/Joomla/fbb-1596-rc-multiple-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''Testimonial Ku 2.0 Admin Panel'''
| Summary: The Joomla component '''Testimonial Ku 2.0''' is vulnerable to persistent XSS in the administrator panel. A malicious user can submit a testimonial containing <script> tags with absolutely no quotes and inject that script into the administrator panel through any of the available inputs except "email". Added November 2009
| [http://jeffchannell.com/Joomla/testimonial-ku-20-admin-panel-persistent-xss.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''MS Comment 0.8.0b'''
| Summary '''MS Comment 0.8.0b for Joomla''', a commenting plugin, suffers from an multiple vulnerabilities. Added November 2009
| [http://jeffchannell.com/Joomla/ms-comment-080b-multiple-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:#cef2e0; color:black" | '''!JoomlaComment 4.0 beta1'''
| Summary: '''!JoomlaComment 4.0 beta1''', a commenting plugin, suffers from multiple XSS vulnerabilities. Added November 2009
| [http://jeffchannell.com/Joomla/joomlacomment-40-beta1-multiple-xss-vulnerabilities.html Alert]
| style="background:#cef2e0; color:white" | ''' [http://compojoom.com/blog/8-news/121-joomlacomment-40-rc1-released Developer Notice 4.0 rc1]''
|-
| style="background:red; color:white" | '''WebAmoeba Ticket System 3.0.0'''
| Summary: '''WebAmoeba Ticket System 3.0.0''', a Joomla help desk component. The vulnerability is with the BBCode library used to parse BBCode tags, as it does not strip javascript: urls from [url] tags. Added November 2009
| [http://jeffchannell.com/Joomla/webamoeba-ticket-system-300-bbcode-xss.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Kunena 1.5.x'''
|Summary: This is an important security release and users are urged to update immediately. Five security issues and an Internet Explorer 8 table bug have been resolved in this release. This release also contains many other important bug fixes. Added 18 November 2009
|[http://www.kunena.com/blog/19-developer-blog/51-kunena-157-security-release-now-available Advisory]
|style="background:#cef2e0; color:white" |[http://www.kunena.com/blog/19-developer-blog/52-kunena-158-service-release-now-available Latest 1.5.8 Version]
|-
| style="background:red; color:white" | '''com_siirler'''
| Summary: SQL injection vulnerability in the '''Q-Proje Siirler Bileseni (com_siirler)''' component 1.2 RC for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in an sdetay action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3972 | CVE-2009-3972]]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''jTips (com_jtips)'''
|SUmmary:SQL injection vulnerability in the '''jTips (com_jtips)''' component 1.0.7 and 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the season parameter in a ladder action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3971 |CVE-2009-3971]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''NinjaMonials'''
| Summary: SQL injection vulnerability in the '''NinjaMonials (com_ninjacentral)''' component 1.1.0 for '''Joomla 1.0.x''' ! allows remote attackers to execute arbitrary SQL commands via the testimID parameter in a display action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3964 | CVE-2009-3964]]
|style="background:#cef2e0; color:white" |''' [http://ninjaforge.com/index.php?option=com_ninjacentral&page=show_package&id=14&Itemid=235 developer patch Ver 1.2]'''
|-
|style="background:#cef2e0; color:black" | '''webee 1.1.1 &1.2'''
|Summary: '''webee 1.1.1,''' a Joomla commenting plugin, suffers from multiple vulnerabilities. '''webee has been updated to 1.2''' as of 12 November 2009 and''' still suffers''' from SQL Injection. XSS was not tested in 1.2. Added 19 November 2009
| [http://jeffchannell.com/Joomla/webee-111-multiple-vulnerabilities.html jeffchannell.com]
|style="background:#cef2e0; color:white" | ''' [http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/10155 developer update ver2.0]'''
|-
|style="background:#cef2e0; color:black" |'''iF Portfolio Nexus'''
|Summary: The '''iF Portfolio Nexus component for Joomla!''' is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements using the id parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. Nov 18, 2009
|[http://secunia.com/advisories/37408/ secunia.com 37408/]
|style="background:#cef2e0; color:white" |[http://www.inertialfate.za.net/help/forums/topic?id=10&p=3#p172 iF Portfolio Nexus v1.1.1 released]

|-
|style="background:red; color:white" | '''JoomClip'''
|Summary: The '''JoomClip component for Joomla!''' is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the index.php script using the cat parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. Nov 18, 2009
|[http://secunia.com/advisories/37400/ secunia.com 37400/]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Joomla XML'''
|Summary: Joomla! before 1.5.15 allows remote attackers to read an extension's XML file, and thereby obtain the extension's version number, via a direct request.
Published: 11/16/2009
|[[NIST:CVE-2009-3946 | CVE-2009-3946]]
|style="background:#cef2e0; color:white" |'''[http://developer.joomla.org/security/news/306-20091103-core-xml-file-read-issue.html Resolution]'''
|-
|style="background:red; color:white" | '''Mygallery Remote SQL Injection Vulnerability'''
|Summary: Joomla Component mygallery ( farbinform_krell) Remote SQL Injection Vulnerability Added 27 Nov 2009 {{JVer|1.5}} NB: This could be an error in our database as the only one we could find was for wordpress.If anyone know of one for joomla please let us know..(poss joomlicious.com CM)
|[http://www.exploit-db.com]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Extreme Google Calendar'''
|Summary: '''com_gcalendar 1.1.2''' (gcid) Remote SQL Injection Vulnerability
Remote SQL Injection were identified in Google Calendar Component [http://extensions.joomla.org/extensions/calendars-a-events/calendars/4188 Extension Link] Added 27 Nov 2009
|[http://www.exploit-db.com reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''LyftenBloggie'''
| Summary: [http://www.lyften.com/products/lyftenbloggie.html LyftenBloggie] Component "author" SQL Injection Vulnerability LyftenBloggie 1.x Added 27 Nov 2009
|[http://secunia.com/advisories/product/28005/ SA37499]
| [http://jeffchannell.com/Joomla/lyften-bloggie-sql-injection-fix.html Un official fix]. Developer fix not release at 30 Nov 09 ''' [http://www.lyften.com/products/lyftenbloggie/extensions/download/id-20.html 1.0.4a (last update on Dec 28, 2009)]'''
|-
|style="background:#cef2e0; color:black" |'''Sermon speaker'''
|Summary: [http://joomlacode.org/gf/project/sermon_speaker sermon speaker] sql vulnerability and password reset vulnerability version 3.2 and below
|
|style="background:#cef2e0; color:white" |[http://joomlacode.org/gf/project/sermon_speaker/forum/?action=ForumBrowse&forum_id=7897&_forum_action=ForumMessageBrowse&thread_id=15219 Developer fix] 30 Nov 2009
|-
|style="background:#cef2e0; color:white" | [http://joomlacode.org/gf/project/musicgallery/ MusicGallery]
|Summary: [http://joomlacode.org/gf/project/musicgallery/ Component MusicGallery] SQL Injection Vulnerability 30 November {{JVer|1.5}}
|[[NIST:CVE-2009-4217 | CVE-2009-4217]]
|style="background:#cef2e0; color:black" | [http://joomlacode.org/gf/project/musicgallery/ developer]
|}

----

== December 2009 Compiled Reports ==
{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''
|-
|style="background:red; color:white" | '''Omilen Photo Gallery'''
|Summary: Directory traversal vulnerability in the [http://extensions.joomla.org/extensions/photos-&-images/photo-flash-gallery/6373/details Omilen Photo Gallery] (com_omphotogallery) component Beta 0.5 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php.
Published: 12/04/2009
|[[NIST:CVE-2009-4202 | CVE-2009-4202]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Seminar'''
|Summary: SQL injection vulnerability in the [http://seminar.vollmar.ws/ Seminar] (com_seminar) component 1.28 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a View_seminar action to index.php.
Published: 12/04/2009
|[[NIST:CVE-2009-4200 | CVE-2009-4200]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Mambo Resident'''
|Summary: Multiple SQL injection vulnerabilities in the Mambo Resident (aka Mos Res or com_mosres) component 1.0f for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) property_uid parameter in a viewproperty action to index.php and the (2) regID parameter in a showregion action to index.php. Mambo Resident component for v4.5.2 '''may only be for 1.0.xx versions of J!'''
Published: 12/04/2009
|[[NIST:CVE-2009-4199 | CVE-2009-4199]]
|style="background:#cef2e0; color:white" |[http://www.jomres.net/ Replacement Extension 08 dec 09]
|-
|style="background:red; color:white" | '''ProofReader'''
|Summary: Multiple cross-site scripting (XSS) vulnerabilities in index.php in the ProofReader (com_proofreader) component 1.0 RC9 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in (1) 404 or (2) error pages. Published: 12/02/2009 CVSS Severity: 4.3 (MEDIUM)
| [[NIST:CVE-2009-4157 | CVE-2009-4157]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Laoneo Google Calendar GCalendar'''
|Summary: SQL injection vulnerability in the [http://g4j.laoneo.net/content/extensions/download/cat_view/20-joomla-15x/21-gcalendar.html Google Calendar GCalendar] (com_gcalendar) component 1.1.2, 2.1.4, and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the gcid parameter. NOTE: some of these details are obtained from third party information. Published: 11/29/2009 CVSS Severity: 7.5 (HIGH) Note: There is already a listing for GCalendar 1.1.2
|[[NIST:CVE-2009-4099 | CVE-2009-4099]]
|style="background:#cef2e0; color:white" | [http://g4j.laoneo.net/content/extensions/download/doc_details/28-gcalendar-suite-215.html Latest version GCalendar Suite 2.1.5]
|-
|style="background:red; color:white" | '''D4J eZine'''
|Summary: PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS mosConfig_absolute_path parameter. Published: 11/29/2009 CVSS Severity: 7.5 (HIGH)
|[[NIST:CVE-2009-4094 | CVE-2009-4094]]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''Quick News'''
| Summary: The Joomla [http://joomlacode.org/gf/project/quicknews/ Quick News component] suffers from a remote SQL injection vulnerability. added 1st Dec 09
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Joaktree component'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/genealogy/9842 Joaktree] Vulnerability : SQL injection/ added 1st Dec 09
|[http://securityreason.com/exploitalert/7508 7508]
|style="background:#cef2e0; color:white" | ''' [http://naastniels.nl/index.php/en/joaktree/downloads version 1.1 update]'''
|-
|style="background:red; color:white" | '''mojoblog'''
|Summary [http://www.joomlify.com/files/mojoblog/ MojoBlog] Multiple Remote File Include Vulnerability added 1st Dec 09 {{JVer|1.5}}
|[http://securityreason.com/exploitalert/7509 7509]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''YJ Whois'''
|Summary: [http://extensions.joomla.org/extensions/external-contents/domain-search/5774 YJ Whois] '''Low security risk''',and fixesMalicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. Files affected is , modules/mod_yj_whois.php added 3 December 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" |[http://www.youjoomla.com/xss-security-patch-for-yj-whois.html Developer Notice and fix 03 dec 09]
|-
|style="background:#cef2e0; color:black" | '''yt_color YOOOtheme'''
|Summary: [http://www.yootheme.com/ YT_color yootheme] Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. added 5 dec 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.yootheme.com/member-area/downloads/item/templates-15/xss-and-php-53-patches All members without an active membership can download the template patches here].'''
|-
|style="background:red; color:white" | '''TP Whois'''
|summary: [http://www.templateplazza.com/view-details/tpwhois/183-component-tp-whois-for-joomla-1.5.x.html TP Whois ] Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. Added 3 december {{JVer|1.5}}
|[http://www.exploit-db.com Refrence]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_job'''
|Summary: Component com_job ( showMoreUse) SQL injection vulnerability Added 9th Dec
|[http://xforce.iss.net/xforce/xfdb/54626 Reference]
| style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''JQuarks'''
|Summary: [http://extensions.joomla.org/extensions/contacts-and-feedback/quiz-a-surveys/10590 JQuarks] SQL injection vulnerability {{JVer|1.5}} added 8th dec 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | [http://www.iptechinside.com/labs/projects/list_files/jquarks Developer Update ]
|-
|style="background:red; color:white" | '''Mamboleto Component 2.0 RC3'''
|Summary: [http://www.fernandosoares.com.br/index.php?option=com_docman&task=cat_view&gid=28&Itemid=28 Mamboleto Component 2.0 RC3]SQL injection vulnerability {{JVer|1.5}} added 12 December
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:#cef2e0; color:black" | ''' JS JOBS'''
|Summary [http://www.joomshark.com/index.php?option=com_content&view=article&id=4&Itemid=8 JS JOBS] Joomla Component com_jsjobs 1.0.5.6 SQL Injection Vulnerabilities {{JVer|1.5}} added 12 December
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.joomsky.com/index.php?option=com_rokdownloads&view=folder&Itemid=3&id=2:components Developer update 1.0.5.7]'''
|-
|style="background:#cef2e0; color:black" | '''corePHP JPhoto'''
|Summary: [http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10365 'corePHP' JPhoto]SQL injection vulnerability {{JVer|1.5}} added 12 December
|[http://secunia.com/advisories/37676/ Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.corephp.com/blog/uber-fast-jphoto-security-release/ Developer Upgrade]'''
|-
|style="background:#cef2e0; color:black" | '''com_virtuemart'''
|Summary: "com_virtuemart" http://virtuemart.net/ '''Version : 1.0''' Vulnerability : SQL injection added Date : 07- dec -09 {{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" |[http://virtuemart.net/ latest version]
|-
|style="background:red; color:white" | ''' Kide Shoutbox'''

|Summary: The Kide Shoutbox (com_kide) component 0.4.6 for Joomla! does not properly perform authentication, which allows remote attackers to post messages with an arbitrary account name via an insertar action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Added: December 08
|[[NIST:CVE-2009-4232 | CVE-2009-4232]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | ''' JoomPortfolio Component'''
|Summary: [http://www.joomplace.com/joomportfolio/joomportfolio.html JoomPortfolio] Input passed via the "secid" parameter to index.php (when "option" is set to "com_joomportfolio" and "task" is set to "showcat") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.The vulnerability is reported in version 1.0.0. Other versions may also be affected. Added: December 18 {{JVer|1.5}}
|[http://secunia.com/advisories/37838/ Reporting Site]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''City Portal (templates?)'''
|Summary: City Portal Blind SQL Injection Vulnerability added: 2009-12-18
|[http://www.exploit-db.com Reference] Possibly this [http://www.youjoomla.com/jclick-city-portal-joomla-template.html tempate]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Event Manager'''
|Summary: [http://www.jforjoomla.com/Joomla-Components/event-manager-15-component.html Event Manager] Blind SQL Injection Vulnerability EDB-ID: 10549
added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | com_zcalendar
|Summary: com_zcalendar Blind SQL-injection Vulnerability
EDB-ID: 10548 added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_acmisc'''
|Summary: com_acmisc SQL injection added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''com_digistore'''
|Summary: com_digistore SQL injection EDB-ID: 10546 added: 2009-12-18 {{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.ijoomla.com/ijoomla-digistore/ijoomla-digistore/ijoomla-digistore-change-log/ Update change log] '''
|-
|style="background:red; color:white" | '''com_jbook'''
|Summary: com_jbook Blind SQL-injection EDB-ID: 10545 added: 2009-12-18 {{JVer|1.0}}
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_personel'''
|Summary: com_personel component for Joomla! is vulnerable to SQL injection.
|[http://xforce.iss.net/xforce/xfdb/54903 iss.net reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''JEEMA Article Collection'''
|Summary: [http://www.forum.jeema.net/component/content/article/4-jeema-article-collection-component/13-about-jeema-article-collection.html JEEMA Article Collection] Input passed via the "catid" parameter to index.php (when "option" is set to "com_jeemaarticlecollection" and "view" is set to "longlook") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. version 1.0.0.1 {{JVer|1.5}} added 22 dec 09
| [http://secunia.com/advisories/37865/ secunia]
|style="background:#cef2e0; color:white" | [http://www.jeema.net/downloads/free-joomla-extensions/joomla-components/12-jeema-joomla-article-collection.htm fixed the same in the version v102.]
|-
|style="background:red; color:white" | '''HotBrackets Tournament Brackets '''
|Summary: The [http://extensions.joomla.org/extensions/sports-a-games/sports/10746 HotBrackets Tournament Brackets] component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. {{JVer|1.5}} added 22 dec
|[http://www.securityfocus.com/bid/37439/ Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Car Manager'''
|Summary: http://webformatique.com/ com_carman Cross Site Scripting Vulnerability added 24 december 09{{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" |'''Schools component'''
|Summary: The 'com_schools' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|[http://www.securityfocus.com/bid/37469 Reference] added 24 dec 09
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''webcamxp'''
|[http://extensions.joomla.org/extensions/communication/video-conference/4490 com_webcamxp] Cross Site Scripting Vulnerabilities Last version 2008 {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''beeheard'''
|[http://extensions.joomla.org/extensions/contacts-and-feedback/testimonials-a-suggestions/10283 beeheard] Blind SQL injection Vulnerability {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://beeheard.cmstactics.com/change-log Version 1.4.2] 04 Jan'''
|-
|style="background:red; color:white" | '''jm-recommend'''
|jm-recommendCross Site Scripting Vulnerabilities. unable to locate on jed. {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | facileforms
| com_facileforms Cross Site Scripting Vulnerabilities. unable to locate on jed. Product considered retired. {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''adagency'''
| [http://www.ijoomla.com/ijoomla-ad-agency/ijoomla-ad-agency/index/ adagency ]Vulnerabilities {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_intuit'''
|[http://www.san-diego-web-designer.com/new-file-download/item/root/aboutimage-igateway-for-joomla.html com_intuit]Local File Inclusion Vulnerability {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.securityfocus.com/bid/37494/discuss Retired]'''
|-
|style="background:red; color:white" | '''MemoryBook'''
|[http://extensions.joomla.org/extensions/calendars-a-events/birthdays-a-historic-events/10868 MemoryBook 1.2] Multiple Vulnerabilities. requires: magic quotes OFF, user account {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''qpersonel'''
|[http://extensions.joomla.org/extensions/directory-a-documentation/thematic-directory/7049 qpersonel ] Cross Site Scripting Vulnerabilities {{JVer|1.0}}[[Image:http://extensions.joomla.org/images/jed/compat_15_legacy.png]] Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''opryknings point'''
|com_oprykningspoint_mc Cross Site Scripting Vulnerabilities {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''trabalhe conosco'''
|com_trabalhe_conosco Cross Site Scripting Vulnerabilities {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''DhForum'''
|com_dhforum SQL Injection Vulnerability. considered retired/EOL Dec. 27 {{JVer|1.0}}1.5 legacy
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''com_morfeoshow'''
|[http://extensions.joomla.org/extensions/photos-a-images/photo-gallery-add-ons/9810 morfeoshow] this was a false report
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:black" | ''' false report'''
|-
|style="background:#cef2e0; color:black" |'''Run Digital Download rd-download'''
|[http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7838 RD Download] Local File Disclosure Vulnerability {{JVer|1.5}} Dec. 30 Version affected not disclosed.
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7838 Version 0.9 relased]
|-
|
|
|
|
|}

----

== January 2010 Reported Vulnerable Extensions ==

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic or the [http://forum.joomla.org/viewforum.php?f=470 extensions] topic clearly marked with the first word in the title being ''Vulnerable'' where the security moderators or JSST team will respond.
''This list is change protected, for updates or editing requests [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
''

[http://docs.joomla.org/Vulnerable_Extensions_List Back To Top]

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''

|-
|style="background:#cef2e0; color:black" |JvideoDirect
|Summary: [http://extensions.joomla.org/extensions/multimedia/video-players-a-gallery/9501 Jvideodirect] SQLi Jan 29
|
|http://www.jvideodirect.com/ Update version 2.5
|style="background:red; color:white" | ''' '''
|-
|style="background:#cef2e0; color:black" |'''JEvent search plugin'''
|Summary: JEvent search plugin for [http://extensions.joomla.org/extensions/calendars-a-events/events/95 JEvent] SQLi reported Jan 29
|
|style="background:#cef2e0; color:white" | ''' [http://www.jevents.net/forum/viewtopic.php?f=17&t=3910#p15526 upgrade to 1.5.3b]'''
|
|-
|style="background:#cef2e0; color:black" |'''Kunena'''
|Summary: [http://extensions.joomla.org/extensions/communication/forum/7256/details kunena] re reported suffering SQLi in version 1.5.9 Jan 29 Confirmation Required '''Now found to be malicious'''
|
|style="background:#cef2e0; color:black" | ''' [http://www.kunena.com/blog/19-developer-blog/51-kunena-157-security-release-now-available Versions 1.5.5 and below only]'''
|
|-
|style="background:red; color:white" |'''JE Quiz'''
|Summary : http://extensions.joomla.org/extensions/contacts-and-feedback/quiz-a-surveys/11212 JeQuiz SQLi reported 29 Jan
|
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black"" |'''idoblog'''
|summary: exploitable due to open file permissions. 28 Jan
|Private Notification
|style="background:#cef2e0; color:black" | ''' [http://idojoomla.com/news.html build 35 released] '''
|-
|style="background:#cef2e0; color:black" |'''ccnewsletter'''
|Summary [http://extensions.joomla.org/extensions/5112/details ccnewsletter Directory Traversal Vulnerability] Jan 28
|Private Notification
|style="background:#cef2e0; color:white" | ''' [http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html version 1.0.6 released 29 Jan]'''
|-
|style="background:#cef2e0; color:white" |'''Virtuemart 1.1.4'''
|Summary: [http://extensions.joomla.org/extensions/e-commerce/shopping-cart/129 virtuemart] Input var order_status_id is vulnerable to SQLi NB Requires Higher Level access before exploiting. Jan 27
|
|style="background:#cef2e0; color:black" | ''' [http://forum.joomla.org/viewtopic.php?p=2027005#p2027005 developer patches]'''
|-
|style="background:#cef2e0; color:black" |'''JBDiary'''
|Summary: [http://extensions.joomla.org/extensions/calendars-a-events/events/11009 JBDiary] BLIND SQL Injection Vulnerabilities Jan 24 [http://www.jb-soft.nl/ http://www.jb-soft.nl/]
|
|style="background:#cef2e0; color:white" | ''' [http://www.jb-soft.nl/index.php?option=com_content&view=article&id=64 Developer Update 27 Jan]'''
|-
|style="background:#cef2e0; color:black" |'''JbPublishDownFp'''
|Sumary: [http://extensions.joomla.org/extensions/news-production/timed-content/6496 JbPublishDownFp] SQL Injection Vulnerability Jan 24 [http://www.jb-soft.nl http://www.jb-soft.nl]
|
|style="background:#cef2e0; color:white" |''' [http://www.jb-soft.nl/index.php?option=com_content&view=article&id=64 Developer Update Jan 27]'''
|-
|style="background:red; color:white" |'''com_casino'''
|Summary: [http://extensions.joomla.org/extensions/sports-a-games/tips-a-betts com_casino]
SQL Injection Vulnerabilities Jan24
|
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Mochigames'''
|Summary: [http://extensions.joomla.org/extensions/search/mochigames com_Mochigames]
SQL Injection Vulnerabilities Jan24
|
|style="background:#cef2e0; color:white" | ''' [http://www.yoflash.com/download.html mochigames_alpha052 Released]'''
|-
|style="background:red; color:white" |'''ContentBlogList'''
|Summary: [http://extensions.joomla.org/extensions/news-production/blog/10989 com_ContentBlogList] SQL Injection Vulnerability Jan 23
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |MailChimp for Joomla 1.5
|Summary: [http://extensions.joomla.org/extensions/bridges/mailing-a-newsletter-bridges/7836 MailChimp for Joomla 1.5] jan 17
|Developer Statement
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''JoomlaXML'''
|Summary: [http://extensions.joomla.org/extensions/tools/design-tools/5020 JoomlaXML] malicious code insertion
|
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''JVClouds3D SWF module'''
|[http://joomlapro.ru/3djvclouds JVClouds3D SWF module] Cross Site Scripting . jan 14
|[http://xforce.iss.net/xforce/xfdb/55535 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''JVClouds3D'''
|[http://joomlapro.ru/3djvclouds JVClouds3D module] Cross Site Scripting . jan 14
|[http://xforce.iss.net/xforce/xfdb/55534 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''JA Showcase'''
|[http://www.joomlart.com/addons/components_and_modules/ja_showcase.html JA Showcase component] Directory Traversal jan 14
|[http://xforce.iss.net/xforce/xfdb/55512 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''jprojects'''
|Summary: Unknown Author com_j-projects Blind SQL Injection Vulnerability. Jan 10 detail update
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''jEmbed-Embed Anything'''
|[http://www.joshprakash.com/index.php?option=com_docman&task=doc_details&gid=70 jEmbed-Embed Anything] A vulnerability has been discovered in the jEmbed-Embed Anything component for Joomla, which can be exploited by malicious people to conduct SQL injection attacks. Jan 10
|[http://secunia.com/advisories/38112 Secunia Advisory: SA38112]
|style="background:red; color:white" | [http://extensions.joomla.org/extensions/3699/details Product considered retired]
|-
|style="background:#cef2e0; color:black" |'''perchagallery '''
|Summary: perchagallery [http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10350 com_perchagallery] SQL Injection Vulnerability Jan 7
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.percha.com/index.php?option=com_phocadownload&view=file&id=22:1.5&Itemid=20 Developer Update 1.5b]'''
|-
|style="background:#cef2e0; color:black" | '''CARTwebERP'''
|Summary: [http://extensions.joomla.org/extensions/bridges/e-commerce-bridges/8753 CARTwebERP] Local File Inclusion Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://extensions.joomla.org/extensions/bridges/e-commerce-bridges/8753 1.56.76 (last update on Jan 11, 2010)]'''
|-
|style="background:#cef2e0; color:black" | '''JoomlaBibleStudy'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/religion/3461 JoomlaBibleStudy] LFI Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | '''[http://joomlabiblestudy.org/invisible-downloads/category/3-component.html Developer reported update]'''
|-
|style="background:#cef2e0; color:black" | '''com_bfsurvey_basic and pro'''
|Summary: [http://www.tamlyncreative.com.au/software/ BFsurvey] SQL Injection Vulnerability ,LFI Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.tamlyncreative.com.au/software/forum/index.php?topic=641.0 Developer Update announcement]'''
|-
|style="background:red; color:white" | '''Alfresco'''
|Summary: SQL Injection Vulnerability. Not believed to be Joomlatools extension Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''abbrev'''
|Summary: [http://extensions.joomla.org/extensions/directory-a-documentation/glossary-a-dictionary/4965 abbrev] Local File Inclusion Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''countries'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/development/6553 countries] SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Dedicated Component com_tpjobs'''
|Summary: [http://www.templateplazza.com/ tpjobs] SQL Injection Vulnerability unable to locate files probably template plaza Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.templateplazza.com/extensions-updates/tpjobs-component-update-v-1.1.html Developer Update] '''
|-
|style="background:red; color:white" | '''Component com_doqment'''
|SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Component com_otzivi'''
|Blind SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''aprice'''
|Summary: [http://adeptweb.info/component/option,com_aprice/Itemid,109/ com_aprice] Component 'analog' Parameter SQL Injection Vulnerability
|[http://www.securityfocus.com/bid/37575 Report]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''cartikads'''
|Summary: [http://www.cartikahosting.com com_cartikads] Remote File Upload Vulnerability
'''Mambo''' Open Source ads management component
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Docman seller'''
|Summary: [http://extensions.joomla.org/extensions/e-commerce/subscriptions/5000 Document seller] Input passed via the "id" parameter to index.php (when "option" is set to "com_dm_orders", "task" is set to "order_form", and "payment_method" is set to "Paypal") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
|[http://secunia.com/advisories/38024/ secunia]
|style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/e-commerce/subscriptions/5000 Updated 10th Jan]
|-
|style="background:#cef2e0; color:black" | '''ozio gallery'''
|summary: [http://extensions.joomla.org/extensions/photos-a-images/photo-flash-gallery/4883 Ozio Gallery2] SQLi eploit
|[http://www.viruslist.com/en/advisories/37974 Reference]
|style="background:#cef2e0; color:white" |[http://oziogallery.joomla.it/index.php?option=com_content&view=article&id=62%3Anuova-ozio-gallery-23-aggiornamento-di-sicurezza&catid=2%3Anotizie&Itemid=13&lang=en developer update Jan 11]
|-
|style="background:#cef2e0; color:black" | '''RD-Autos Free'''
|[http://extensions.joomla.org/extensions/vertical-markets/vehicles/5458 RD-Autos Free ] This version is now commercial not free
|Private advisory to JED Jan 11
|style="background:red; color:white" | ''' Product Retired and replaced'''
|-
|style="background:red; color:white" | '''DailyMeals'''
|Summary: [http://extensions.joomla.org/extensions/vertical-markets/food-a-beverage/4764 dailymeals] Local File Inclusion Vulnerability Jan 02
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''RD-Autos Pro'''
|[http://extensions.joomla.org/extensions/vertical-markets/vehicles/6357 RD Autos Pro]
|Private advisory to JED Jan 11
|style="background:#cef2e0; color:black" | ''' Upgrade to Latest version be 2.0.2'''
|-
|
|
|
|
|}

== New format Feed Starts Here ==
Please do not change your [http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions feed url], only the feed format has changed.

== February, March, April, May 2010 Reported Vulnerable Extensions ==
<startFeed />

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic clearly marked with the first word in the title being ''Vulnerable Report'' where the security moderators or JSST team will respond. For a guide to the [http://docs.joomla.org/Vulnerable_Extensions_List_0210#Codes_used codes]

[http://docs.joomla.org/Vulnerable_Extensions_List Previous Reports]

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Date Added'''
! class="unsortable" |'''Extension Update Link & Date'''
|-
|style="background:red; color:white" |

== JE Poll ==
|http://slideshow.joomlaextensions.co.in/ SQL Injection Vulnerability
|
|
|-
|style="background:red; color:white" |

== MyCar ==
|http://www.unisoft.me/extensions/ sqli ID
|
|
|-
|style="background:red; color:white" |

== MediQnA ==
|MediQnA LFI vulnerability version : v1.1
|
|
|-
|style="background:red; color:white" |

== JE Job ==
|http://joomlaextensions.co.in/ LFI SQLi
|
|
|-
|style="background:#cef2e0; color:black"|

== BF Quiz ==
|SQL Injection Exploit Version(s) = 1.3.0
|
|[http://www.tamlyncreative.com.au/software/forum/index.php?topic=729.0 Developer update to BF Quiz v1.3.1]
|-
|

== ==
|
|
|
|-
|style="background:#cef2e0; color:black"|

== Ozio Gallery 2 ==
|DT and open email relay
|280510
|[http://oziogallery.joomla.it/index.php?option=com_content&view=article&id=65:rilasciata-la-versione-ozio-gallery-25&catid=2:notizie&Itemid=13&lang=en Developer update and security release] 010610
|-
|style="background:red; color:white" |

== SectionEx ==
|Stack Ideas section Ex LFI
|
|
|-
|style="background:red; color:white" |

== ActiveHelper LiveHelp ==
|XSS in [http://extensions.joomla.org/extensions/communication/chat/12492 LiveHelp]
|200510
|
|-
|style="background:#cef2e0; color:black"|
== RS Comments ==
|XSS Vulnerability
|
|http://www.rsjoomla.com/customer-support/documentations/96--general-overview-of-the-component/393-changelog.html - fix posted 210510
|-
|style="background:red; color:white" |

== BCA RSS Feed ==
|LFI and other vulnerabilities
|
|Since changed its name to NinjaRss
|-
|

== SimpleDownload ==
|http://extensions.joomla.org/extensions/directory-a-documentation/downloads/10717 various exploits
|160510
|updated version (version 0.9.6)
|-
|style="background:red; color:white" |
== JE Quotation Form ==
|http://joomlaextensions.co.in/free-download/doc_download/11-je-quotation-form.html LFI
|
|
|-
|style="background:red; color:white" |

== konsultasi ==
|SQL Injection Vulnerability
|
|
|-
|style="background:red; color:white" |

== Aardvertiser ==
|Local File Inclusion Vulnerability
http://extensions.joomla.org/extensions/ads-a-affiliates/classified-ads/9454
|
|
|-
|style="background:red; color:white" |

== Seber Cart ==
|Local File Disclosure Vulnerability
|
|[http://www.sebercart.com/index.php?option=com_content&view=article&id=158 Developer Update 140510]
|-
| style="background:#cef2e0; color:black"|

== FDione Form Wizard ==
|lfi vulnerability
|140510 200510
|[dionesoft.com Update to Dione Form Wizard (v. 1.0.4)].
|-
| style="background:#cef2e0; color:black"|

== Custom PHP Pages ==
|http://extensions.joomla.org/extensions/edition/custom-code-in-content/5057 LFI Vulnerability
|
|[fijiwebdesign.com Developer declares not vulnerable 140510]
|-
|style="background:red; color:white" |

== Camp26 Visitor ==
|RFI www.camp26.biz
|
|
|-
|style="background:#cef2e0; color:black"|

== iJoomla News Portal ==
|RFI SID
|
|[http://www.ijoomla.com/forum/index.php/topic,4480.0.html Update to 1.5.10]
|-
| |

== article Factory Manager ==
|RFI & Input Validation Error http://www.thefactory.ro/shop/joomla-components/article-manager.html
|may 2010
|can not reproduce and unproven, http://www.thefactory.ro
|-
|style="background:red; color:white" |

== Table JX Component ==
|http://www.toolsjx.com/ Table JX Component XSS
|060510 - update 130510
|Version: 1.5.5 considered unsafe
|-
|style="background:red; color:white" |

== JE Property ==
|JE Property Finder Upload Vulnerability
|
|
|-
|style="background:red; color:white" |

== Noticeboard ==
|Noticeboard for Joomla "controller" Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

==SmartSite ==
|SmartSite com_smartsite Local File Inclusion Vulnerability
|
|
|-
|style="background:#cef2e0; color:black" |

== ABC ==
|ABC SQL Injection Vulnerability
|
|reported as updated to JED 290410
|-
|style="background:red; color:white" |

== htmlcoderhelper graphics ==
|htmlcoderhelper graphics v1.0.6 LFI Vulnerability
|
|
|-
|style="background:red; color:white" |

== Ultimate Portfolio ==
|Ultimate Portfolio Local File Inclusion Vulnerability
|
|
|-
|style="background:#cef2e0; color:black" |

== huruhelpdesk ==
|http://www.huruhelpdesk.net sqli injection
|
|[http://www.huruhelpdesk.net/forums/8-announcements/392--sql-injection-reveals-user-md5-password-hash Reported fix]
|-
|style="background:red; color:white" |

== Archery Scores ==
| [http://lispeltuut.org/ Archery Scores (com_archeryscores) v1.0.6 LFI Vulnerability]

|210410
|
|-
|style="background:red; color:white" |

== ZiMB Manager ==
|Joomla Component ZiMB Manager Local File Inclusion Vulnerability
|210410
|
|-
|style="background:red; color:white" |

== Matamko ==
|Matamko Local File Inclusion Vulnerability
|210410
|
|-
|style="background:red; color:white" |

== Multiple Root ==
|Multiple Root Local File Inclusion Vulnerability http://joomlacomponent.inetlanka.com/
|
|
|-
|style="background:red; color:white" |

== Multiple Map ==
|Multiple Map Local File Inclusion Vulnerability joomlacomponent.inetlanka.com
|
|
|-
|style="background:red; color:white" |

== Contact Us Draw Root Map ==
|Draw Root Map Local File Inclusion Vulnerability joomlacomponent.inetlanka.com
|
|
|-
|style="background:red; color:white" |

== iF surfALERT ==
|[http://www.inertialfate.za.net/ iF surfALERT] Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

== GBU FACEBOOK ==
|GBU FACEBOOK SQL injection vulnerability http://www.gbugrafici.nl/gbufacebook/
|
|
|-
|style="background:red; color:white" |

== jnewspaper ==
|jnewspaper (cid) SQL Injection Vulnerability
|
|
|-
|style="background:#cef2e0; color:black"|

== JTM Reseller ==
|TM Reseller SQL injection vulnerability
|
|[http://jtmreseller.com/ Developer Update]
|-
|style="background:#cef2e0; color:black" |

== media Mall Factory ==
|SQLi
|200410
| [http://www.thefactory.ro/contact-us/product-update-request.html Solution: update to 1.0.5]

|-
|style="background:#cef2e0; color:black"|

== Gadget Factory ==
|LFi
|200410
|[http://www.thefactory.ro/contact-us/product-update-request.html Solution: update to 1.5.1]
|-
|style="background:#cef2e0; color:black"|

== Deluxe Blog Factory ==
|SQLi
|200410
|[http://www.thefactory.ro/contact-us/product-update-request.html update to 1.1.2]
|-
|

== ==
|
|
|-
|style="background:red; color:white" |
== MT Fire Eagle ==

|LFI http://joomlacode.org/gf/project/jfireeagle/frs/ http://www.moto-treks.com
| 190410
| product considered retired and to be replaced by dev
|-

|

== com properties ==
| http://com-property.com/ SQL I
|
|[http://www.com-property.com/images/fbfiles/files/properties-20100413.txt developer announced fix]
|-
|style="background:red; color:white"|

== Sweetykeeper ==
|Sweetykeeper Local File Inclusion Vulnerability http://www.joomlacorner.com/
|120410
|
|-
|style="background:red; color:white"|

== jvehicles ==
|SQL Injection http://jvehicles.com
|120410
|
|-
|style="background:red; color:white"|

== worldrates ==
|http://dev.pucit.edu.pk/
|120410
|
|-
|style="background:red; color:white"|

== cvmaker ==
|http://dev.pucit.edu.pk/
|
|
|-
|style="background:red; color:white"|

== advertising ==
|http://dev.pucit.edu.pk/
|
|
|-
|style="background:red; color:white"|

== horoscope ==
|http://dev.pucit.edu.pk/
|120410
|
|-
|style="background:red; color:white"|

== webtv ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:red; color:white"|

== diary ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:#cef2e0; color:black"|

== Multi-Venue Restaurant Menu Manager (MVRMM) ==
|http://www.focusdev.co.uk/
|120410
||[http://extensions.joomla.org/extensions/vertical-markets/food-a-beverage/10015 Version 1.5.2 Stable Update 4]
|-
|style="background:red; color:white"|

== Memory Book ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:red; color:white"|

== TRAVELbook ==
| http://www.demo-page.de/
|120410
|-
|style="background:#cef2e0; color:black"|

== AlphaUserPoints ==
|
|[http://www.alphaplug.com/index.php/downloads.html?func=fileinfo&id=31 developer upgrade]

|-
|style="background:red; color:white"|

== JprojectMan ==
|LFI http://extensions.joomla.org/extensions/communities-a-groupware/project-a-task-management/5676
|110410
|-
|style="background:#cef2e0; color:black"|

== CKForms ==
|1.3.4 release - Important LFI security fix [http://joomlacode.org/gf/project/ckforms/news/?action=NewsThreadView&id=2814 ]
|07-04-10
|[http://ckforms.cookex.eu/download/download.php upgrade]
|-
|style="background:red; color:white"|

== econtentsite ==
|LFI
|040410
|-
|style="background:red; color:white"|

== Jvehicles ==
|ID
|040410
|-
|

== ==
|
|
|-
|style="background:#cef2e0; color:black"|

== smestorage ==
|[http://www.smestorage.com SMEStorage] LFI

|Updated 29 March 10
|[http://gelembjuk.com/index.php?option=com_content&view=section&layout=blog&id=1&Itemid=55 developer fix] to 1.1
|-
|style="background:#cef2e0; color:black"|

== JE Tooltip ==
|[http://joomlaextensions.co.in/formcreator/ JE Tooltip] LFI
|Updated 23 March
|-
|style="background:#cef2e0; color:black"|

== Gift Exchange Beta ==
|[http://extensions.joomla.org/extensions/communities-a-groupware/membership/11680 Gift exchange] SQLi
|Updated 23 March
|[http://socialables.com/28-Jomsocial/Gift-Exchange/flypage.tpl.html upgrade beta 1.0.1]

|-
|style="background:#cef2e0; color:black"|

== RokDownloads ==
|[[http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7967 LFI]]
|15 march 2010
||upgrade to [http://www.rockettheme.com/extensions-updates/638-rokdownloads-10-released version 1.0]
|-
|style="background:red; color:white"|

== gigcalender ==

|SQLi [http://extensions.joomla.org/extensions/calendars-a-events/events/97)http://extensions.joomla.org/extensions/calendars-a-events/events/97 gigcalender]
|13 march 2010
|
|-
|style="background:red; color:white"|

== heza content ==
|SQLi [http://extensions.joomla.org/extensions/structure-a-navigation/sections-a-categories/10427)http://extensions.joomla.org/extensions/structure-a-navigation/sections-a-categories/10427 heza content]
|13 march 2010
|
|-
|style="background:red; color:white"|

== juliaportfolio ==
|LFI [http://extensions.joomla.org/extensions/directory-&-documentation/portfolio/8519/details juliaportfolio]
|13 march 2010
|
|-

|style="background:#cef2e0; color:black" |

== Flash Magazine Deluxe ==
|SQL Injection Vulnerability.
|Feb 25
|'''[http://www.joomplace.com/flash-magazine-deluxe/flash-magazine-deluxe-description.html Developer Update Version 2.0.11 09/03/10]'''
|-
|style="background:red; color:white" |

== SqlReport ==
|Sqlreport has a sql/RFI exploit. awaiting confirmation on exact developer.
|Feb 20
|'''Not Known'''
|-
|style="background:#cef2e0; color:black" |

== Scriptegrator ==
|Core Design [http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html Scriptegrator] RFI exploit
|Feb 20
|[http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html Dev Upgrade announcement]
|-
|style="background:#cef2e0; color:black" |

== AllVideos 3.1 ==
|
A vulnerability discovered in versions 3.0. and 3.1 of the plugin can be exploited by malicious people to disclose potentially sensitive information. For security reasons we will not be providing further details to safeguard users of affected versions. http://www.joomlaworks.gr/content/view/77/34/]|
|17 Feb
| [http://joomlaworks.googlecode.com/files/plg_jw_allvideos-v3.3_j1.5.zip Version 3.3 release 18th]
|-
|style="background:#cef2e0; color:black" |

== RW Cards ==
| [http://extensions.joomla.org/extensions/3430/details RW Card] LFI and ID exploit [http://www.weberr.de/ Dev Site]
|180210
|style="background:#cef2e0; color:black" |''' [http://www.weberr.de/index.php/forum.html?func=view&catid=5&id=1939&limit=6 developer update]'''
|-
|style="background:red; color:white" |

== Yelp ==
| SQLi - Unable to locate developer. Possibly a custom extension.
|Feb 01
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |

== '''Autartitarot''' ==
|Directory Traversal. Back end access required
| Feb 05
|style="background:#cef2e0; color:black" | ''' Please upgrade to [http://www.autartica.be/en/autartitarot version 1.0.4]'''
|-
|style="background:#cef2e0; color:black" |

== communitypolls ==
|LFI - [http://www.corejoomla.com/ community polls]
|Feb 17
||upgrade to [http://www.corejoomla.com/ version 1.5.3]
|-
|

== ==
|
|
|
|}
<endFeed />

''This list is change protected, for updates or additions [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
''

== Codes used ==
SQLi - SQL injection [http://en.wikipedia.org/wiki/Code_injection#SQL_injection wikipedia]

LFI - Local File Inclusion [http://www.scribd.com/doc/6498408/Remote-and-Local-File-Inclusion-Explained scribd]

RFI - Remote file inclusion [http://en.wikipedia.org/wiki/Remote_File_Inclusion wikipedia]

DT - Directory Traversal [http://en.wikipedia.org/wiki/Directory_traversal wikipedia]

ID = Information Disclosure: account information or sensitive information publicly viewable

== Developers - How to get yourself removed from the VEL ==

Resolved items will be removed after a suitable period and not on resolution

Please solve the issues and:

* If JED listed
Attach the new zip file at your actual JED listing.

Change the extension version at JED listing.

Contact the JED by mail back with a notice and ask them republish your listing.

* If not JED listed.
Inform us by PM of the link to your resolution notice on your website.

== Future Actions & WIP ==

[http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions RSS feed] completed

to feed VEL direct to twitter

== Notes ==
The RSS feed is currently fed by item entry order and not by date fixed.
List as discussed in [[jtopic:455746]] by [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=67439 PhilD] editing by [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville]

----
[[Category:Security]]
[[Category:Security_FAQ]]

----

Archived:Vulnerable Extensions List

2010-06-03T08:31:05Z

Hidabe:

{{RightTOC}}
== Check and Report. ==

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic or the [http://forum.joomla.org/viewforum.php?f=470 extensions] topic clearly marked with the first word in the title being ''Vulnerable'' where the security moderators or JSST team will respond.
This list is change protected, for updates or editing requests [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
*If you are seeing this page on any site other than [http://docs.joomla.org/Vulnerable_Extensions_List the Offical Joomla Documentation] you may be seeing an out of date version or experiencing [http://en.wikipedia.org/wiki/Plagiarism plagiary] and the links may not work properly

== How to use this list ==
'''Items will be removed after a suitable period and not on resolution'''
All known vulnerable extensions are the listed in the first column. Any in a red box are high where we have not been given a fix for. Alert Advisory details in the centre column (the date is in American format mm/dd/yyyy).
The link to the advisory notice.
Finally a link to the notice about any update with link or '''Not Known''' where none is known.

'''This list is compiled from found information and may not be an up to date accurate list''' ''We do '''NOT''' promise to test or validate these reports. We do '''NOT''' guarantee the quality or effectiveness of any updates reported to us or listed here.''
To sign up for the feed please [http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions follow this link]

== November 2009 Compiled Vulnerability Reports. ==

Items are not in any particular order.

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''
|-
| style="background:#cef2e0; color:black" | '''com_ajaxchat'''
| Summary: PHP remote file inclusion vulnerability in Fiji Web Design Ajax Chat ('''com_ajaxchat''') component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter to tests/ajcuser.php.New version release December 22,2009
Published: october 28 2009
| [[NIST:CVE-2009-3822|CVE-2009-3822]]
| style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/communication/chat/10767 update v 1.1]
|-
| style="background:#cef2e0; color:black" | '''com_booklibrary'''
| PHP remote file inclusion vulnerability in doc/releasenote.php in the BookLibrary ('''com_booklibrary''') component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter, a different vector than [[NIST:CVE-2009-2637|CVE-2009-2637]]. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 10/28/2009
CVSS Severity: 7.5 (HIGH)
| [[NIST:CVE-2009-3817|CVE-2009-3817]]
| style="background:#cef2e0; color:black" | '''[http://ordasoft.com/Download/Joomla1.0-extensions/Joomla1.0-components/View-category.html developer site updates]'''
|-
| style="background:#cef2e0; color:black" | '''com_foobla_suggestions'''
| Summary: SQL injection vulnerability in the foobla Suggestions ('''com_foobla_suggestions''') component 1.5.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the idea_id parameter to index.php.
Published: 10/11/2009
CVSS Severity: 7.5 (HIGH)
| [[NIST:CVE-2009-3669|CVE-2009-3669]]
| style="background:#cef2e0; color:white" | [http://foobla.com/news/latest/fixed-foobla-suggestions-for-joomla-idea_id-sql-injection-vulnerability.html developer reported upgrade]
|-
| style="background:red; color:white" | '''com_djcatalog'''
| Summary: Multiple SQL injection vulnerabilities in the DJ-Catalog ('''com_djcatalog''') component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a showItem action and (2) cid parameter in a show action to index.php.
Published: 10/11/2009
CVSS Severity: 6.8 (MEDIUM)
| [[NIST:CVE-2009-3661|CVE-2009-3661]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_cbresumebuilder'''
| Summary: SQL injection vulnerability in the JoomlaCache CB Resume Builder (''''''com_cbresumebuilder''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a group_members action to index.php.
Published: 10/09/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3645|CVE-2009-3645]]
| style="background:#cef2e0; color:white" |'''[http://www.joomlacache.com/commercial-extensions/security-update.html Developer Update]'''
|-
| style="background:red; color:white" | '''com_soundset'''
| Summary: SQL injection vulnerability in the Soundset ('''com_soundset''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php.
Published: 10/09/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3644|CVE-2009-3644]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" |'''com_sportfusion'''
| Summary: SQL injection vulnerability in the Kinfusion SportFusion ('''com_sportfusion''') component 0.2.2 through 0.2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a teamdetail action to index.php.
Published: 09/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3491|CVE-2009-3491]]
| style="background:red; color:white" |'''Not Known'''
|-
| style="background:red; color:white" | '''com_icrmbasic'''
| Summary: A certain interface in the iCRM Basic ('''com_icrmbasic''') component 1.4.2.31 for Joomla! does not require administrative authentication, which has unspecified impact and remote attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 09/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3481|CVE-2009-3481]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_mytube'''
| Summary: SQL injection vulnerability in the MyRemote Video Gallery ('''com_mytube''') component 1.0 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter in a videos action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3446|CVE-2009-3446]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_fastball'''
| Summary: SQL injection vulnerability in the Fastball ('''com_fastball''') component 1.1.0 through 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the league parameter to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3443|CVE-2009-3443]]
| style="background:#cef2e0; color:white" | [http://www.fastballproductions.com latest version] 1.2.1
|-
| style="background:red; color:white" | '''com_facebook'''
| Summary: SQL injection vulnerability in the JoomlaFacebook ('''com_facebook''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a student action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3438|CVE-2009-3438]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_tupinambis'''
| Summary: SQL injection vulnerability in the Tupinambis ('''com_tupinambis''') component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the proyecto parameter in a verproyecto action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3434|CVE-2009-3434]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''com_idoblog'''
| Summary: SQL injection vulnerability in the IDoBlog ('''com_idoblog''') component 1.1 build 30 for Joomla! allows remote attackers to execute arbitrary SQL commands via the userid parameter in a profile action to index.php, a different vector than [[NIST:CVE-2008-2627|CVE-2008-2627]].
Published: 09/25/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3417|CVE-2009-3417]]
| style="background:#cef2e0; color:white" |'''[http://idojoomla.com/download.html/ '''New Version v 1.1''' (build 32)]'''
|-
| style="background:red; color:white" | '''com_hbssearch'''
| Summary: Cross-site scripting ('''XSS''') vulnerability in the Hotel Booking Reservation System ('''aka HBS or com_hbssearch''') component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the adult parameter in a showhoteldetails action to index.php.
Published: 09/24/2009
CVSS Severity: 4.3 ('''MEDIUM''')
| [[NIST:CVE-2009-3368|CVE-2009-3368]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_hbssearch'''
| Summary: Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System ('''aka HBS or com_hbssearch''') component for Joomla! allow remote attackers to execute arbitrary SQL commands via the ('''1''') h_id, ('''2''') id, and ('''3''') rid parameters to longDesc.php, and the h_id parameter to ('''4''') detail.php, ('''5''') detail1.php, ('''6''') detail2.php, ('''7''') detail3.php, ('''8''') detail4.php, ('''9''') detail5.php, ('''10''') detail6.php, ('''11''') detail7.php, and ('''12''') detail8.php, different vectors than [[NIST:CVE-2008-5865|CVE-2008-5865]], [[NIST:CVE-2008-5874|CVE-2008-5874]], and [[NIST:CVE-2008-5875|CVE-2008-5875]].
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3357|CVE-2009-3357]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''com_alphauserpoints'''
| Summary: SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints ('''com_alphauserpoints''') component 1.5.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the username2points parameter.
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3342|CVE-2009-3342]]
| style="background:#cef2e0; color:white" |'''[http://www.alphaplug.com/index.php/news/142-alphauserpoints-153-released.html 1.5.3]'''
|-
| style="background:red; color:white" | '''TurtuShout'''
| Summary: SQL injection vulnerability in the TurtuShout component 0.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Name field.
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3335|CVE-2009-3335]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_jinc'''
| Summary: SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component ('''aka JINC or com_jinc''') component 0.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a messages action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3334|CVE-2009-3334]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_jbudgetsmagic'''
| Summary: SQL injection vulnerability in the JBudgetsMagic ('''com_jbudgetsmagic''') component 0.3.2 through 0.4.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the bid parameter in a mybudget action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3332|CVE-2009-3332]]
| style="background:#cef2e0; color:black" | '''[http://sopinet.com/jbudgetsmagic/index.php?option=com_remository&Itemid=5&lang=en Update to 0.4.1]'''
|-
| style="background:red; color:white" | '''com_surveymanager'''
| Summary: SQL injection vulnerability in the Focusplus Developments Survey Manager ('''com_surveymanager''') component 1.5.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the stype parameter in an editsurvey action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3325|CVE-2009-3325]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_album'''
| Summary: Directory traversal vulnerability in the Roland Breedveld Album ('''com_album''') component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. ('''dot dot''') in the target parameter to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3318|CVE-2009-3318]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_jreservation'''
| Summary: SQL injection vulnerability in the [http://extensions.joomla.org/extensions/vertical-markets/booking-a-reservation/9798 JReservation] ('''com_jreservation''') component 1.0 and 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a propertycpanel action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3316|CVE-2009-3316]]
| style="background:#cef2e0; color:black" | [http://www.jforjoomla.com Updated 28th] Jan fixed 13th Nov
|-
| style="background:red; color:white" | '''IXXO Cart Standalone'''
| Summary: SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, and the IXXO Cart component for Joomla! 1.0.x, allows remote attackers to execute arbitrary SQL commands via the parent parameter.
Published: 09/16/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3215|CVE-2009-3215]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_digifolio'''
| Summary: SQL injection vulnerability in the DigiFolio ('''com_digifolio''') component 1.52 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a project action to index.php.
Published: 09/15/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3193|CVE-2009-3193]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_aclassf'''
| Summary: Cross-site scripting ('''XSS''') vulnerability in '''gmap.php''' in the Almond Classifieds ('''com_aclassf''') component 7.5 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the addr parameter.
Published: 09/10/2009
CVSS Severity: 4.3 ('''MEDIUM''')
| [[NIST:CVE-2009-3155|CVE-2009-3155]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_aclassf'''
| Summary: SQL injection vulnerability in the Almond Classifieds ('''com_aclassf''') component 7.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action to index.php, a different vector than [[NIST:CVE-2009-2567|CVE-2009-2567]].
Published: 09/10/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3154|CVE-2009-3154]]
| style="background:#cef2e0; color:white" | [http://www.almondsoft.com/alcl.html Developer latest component]
|-
| style="background:red; color:white" | '''com_jabode'''
| Summary: SQL injection vulnerability in Jabode horoscope extension ('''com_jabode''') for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.
Published: 09/08/2009
CVSS Severity: 7.5 ('''HIGH''')

| [[NIST:CVE-2008-7169|CVE-2008-7169]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_gameserver'''
| Summary: SQL injection vulnerability in the Game Server ('''com_gameserver''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a gamepanel action to index.php.
Published: 09/03/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3063|CVE-2009-3063]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_artportal'''
| Summary: SQL injection vulnerability in the Artetics.com Art Portal ('''com_artportal''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the portalid parameter to index.php.
Published: 09/03/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3054|CVE-2009-3054]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_agora'''
| Summary: Directory traversal vulnerability in the Agora ('''com_agora''') component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.
Published: 09/03/2009
CVSS Severity: 6.8 ('''MEDIUM''')
| [[NIST:CVE-2009-3053|CVE-2009-3053]]
| style="background:#cef2e0; color:white" |'''[http://jvitals.com/index.php?option=com_rokdownloads&view=file&Itemid=108&id=282:agora-3-0 3.0.7]'''
|-
| style="background:red; color:white" | '''com_simpleshop'''
| Summary: SQL injection vulnerability in the Simple Shop Galore ('''com_simpleshop''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the section parameter in a section action to index.php, a different vulnerability than [[NIST:CVE-2008-2568|CVE-2008-2568]]. NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
Published: 08/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-7033|CVE-2008-7033]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_groups'''
| Summary: SQL injection vulnerability in the Permis ('''com_groups''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a list action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 08/17/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-2789|CVE-2009-2789]]
| style="background:red; color:white" | '''Not Known'''

|-
| style="background:#cef2e0; color:black" | '''com_content'''
| Summary: SQL injection vulnerability in the content component ('''com_content''') 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a blogcategory action to index.php.
Published: 08/10/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6923|CVE-2008-6923]]
| style="background:#cef2e0; color:white" |'''[http://developer.joomla.org/security/news/305-20091103-core-front-end-editor-issue-.html Resolution]'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: SQL injection vulnerability in the Live Chat ('''com_livechat''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the last parameter to getChatRoom.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6883|CVE-2008-6883]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: Live Chat ('''com_livechat''') component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6882|CVE-2008-6882]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: Multiple SQL injection vulnerabilities in the Live Chat ('''com_livechat''') component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the last parameter to ('''1''') getChat.php, ('''2''') getChatRoom.php, and ('''3''') getSavedChatRooms.php.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6881|CVE-2008-6881]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''JUMI'''
| There is a backdoor in JUMI that installs itself when JUMI is installed on your web site. It sends your credentials to a website, and sets up a back door for remote code execution.
Please remove JUMI2.0.5 immediately.
It will be simple enough to remove the compromised code from this download, but you need to do
a full security audit on your site as well as you have been compromised. Added November 2009
| [http://code.google.com/p/jumi/updates/list Report]
| style="background:#cef2e0; color:white" |[http://code.google.com/p/jumi/updates/list Jumi Update]
|-
| style="background:#cef2e0; color:black" |'''com_photoblog'''
| Input Validation Error Added November 2009
| [http://www.securityfocus.com/bid/36809/ 36809]
| style="background:#cef2e0; color:white" |[http://webguerilla.net/downloads/3-components-for-joomla-1 webguerilla Photoblog alpha 3b]
|-
| style="background:red; color:white" | '''com_jshop'''
| Summary: SQL injection vulnerability in the JShop ('''com_jshop''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a product action to index.php.
Published: 11/02/2009
CVSS Severity: 7.5 '''(HIGH)'''
| [[NIST:CVE-2009-3835|CVE-2009-3835]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''BF Survey Pro'''
| Summary: SQL injection vulnerability in the '''BF Survey Pro''' v1.2.5 or lower (fixed in version 1.2.6). '''BF Survey Basic v1.0''' (fixed in version 1.1). '''BF Quiz v1.1.1''' (fixed in version 1.2 or greater) Added November 2009
| [http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.0 tamlyncreative.com.au]
| style="background:#cef2e0; color:white" |[http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.0 update]
|-
| style="background:#cef2e0; color:black" |'''Joo!BB 0.9.1 '''
| Summary: Persistent XSS/MySQL Injection vulnerabilities in Joo!BB 0.9.1 Added November 2009
| [http://www.joobb.org/community/board/topic/700-MultipleXSSSQLInjectionVulnerabilities.html joob.org]
| style="background:#cef2e0; color:white" |[http://www.joobb.org/downloads/components.html update]
|-
| style="background:#cef2e0; color:black" |'''sh404sef '''
| Summary: sh404sef URI XSS Vulnerability Added November 2009
| [http://jeffchannell.com/Joomla/sh404sef-uri-xss-vulnerability.html jeffchannell.com]
| style="background:#cef2e0; color:white" |[http://extensions.siliana.com/en/2009060876/sh404SEF-and-url-rewriting/Interim-release-of-sh404sef-for-Joomla-1.5.x.html update]
|-
| style="background:#cef2e0; color:black" | '''AWD Wall 1.5'''
| Summary '''AWD Wall 1.5''' Blind SQL Injection Vulnerability.The Joomla component AWD Wall 1.5 suffers from an SQL Injection vulnerability in its handling of the 'cbuser' parameter.Added November 2009
| [http://jeffchannell.com/Joomla/awd-wall-15-blind-sql-injection-vulnerability.html Notice]
|style="background:#cef2e0; color:white" | '''[http://www.awdsolution.com/template_demo/testsite/index.php?option=com_content&view=article&id=48&Itemid=72 developer update]'''
|-
| style="background:red; color:white" | '''EasyBook 2.0.0rc4'''
| Summary: The Joomla component '''EasyBook 2.0.0rc4''' suffers from multiple persistent XSS vulnerabilities. One seems fairly critical, while the others would take some incredible creativity to actively exploit. Added November 2009
| [http://jeffchannell.com/Joomla/easybook-200rc4-multiple-xss-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''F!BB 1.5.96'''
| Summary: The Joomla component '''F!BB 1.5.96 RC''' suffers from multiple persistent XSS vulnerabilities, as well SQL Injection in its user search feature. Added November 2009
| [http://jeffchannell.com/Joomla/fbb-1596-rc-multiple-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''Testimonial Ku 2.0 Admin Panel'''
| Summary: The Joomla component '''Testimonial Ku 2.0''' is vulnerable to persistent XSS in the administrator panel. A malicious user can submit a testimonial containing <script> tags with absolutely no quotes and inject that script into the administrator panel through any of the available inputs except "email". Added November 2009
| [http://jeffchannell.com/Joomla/testimonial-ku-20-admin-panel-persistent-xss.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''MS Comment 0.8.0b'''
| Summary '''MS Comment 0.8.0b for Joomla''', a commenting plugin, suffers from an multiple vulnerabilities. Added November 2009
| [http://jeffchannell.com/Joomla/ms-comment-080b-multiple-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:#cef2e0; color:black" | '''!JoomlaComment 4.0 beta1'''
| Summary: '''!JoomlaComment 4.0 beta1''', a commenting plugin, suffers from multiple XSS vulnerabilities. Added November 2009
| [http://jeffchannell.com/Joomla/joomlacomment-40-beta1-multiple-xss-vulnerabilities.html Alert]
| style="background:#cef2e0; color:white" | ''' [http://compojoom.com/blog/8-news/121-joomlacomment-40-rc1-released Developer Notice 4.0 rc1]''
|-
| style="background:red; color:white" | '''WebAmoeba Ticket System 3.0.0'''
| Summary: '''WebAmoeba Ticket System 3.0.0''', a Joomla help desk component. The vulnerability is with the BBCode library used to parse BBCode tags, as it does not strip javascript: urls from [url] tags. Added November 2009
| [http://jeffchannell.com/Joomla/webamoeba-ticket-system-300-bbcode-xss.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Kunena 1.5.x'''
|Summary: This is an important security release and users are urged to update immediately. Five security issues and an Internet Explorer 8 table bug have been resolved in this release. This release also contains many other important bug fixes. Added 18 November 2009
|[http://www.kunena.com/blog/19-developer-blog/51-kunena-157-security-release-now-available Advisory]
|style="background:#cef2e0; color:white" |[http://www.kunena.com/blog/19-developer-blog/52-kunena-158-service-release-now-available Latest 1.5.8 Version]
|-
| style="background:red; color:white" | '''com_siirler'''
| Summary: SQL injection vulnerability in the '''Q-Proje Siirler Bileseni (com_siirler)''' component 1.2 RC for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in an sdetay action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3972 | CVE-2009-3972]]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''jTips (com_jtips)'''
|SUmmary:SQL injection vulnerability in the '''jTips (com_jtips)''' component 1.0.7 and 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the season parameter in a ladder action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3971 |CVE-2009-3971]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''NinjaMonials'''
| Summary: SQL injection vulnerability in the '''NinjaMonials (com_ninjacentral)''' component 1.1.0 for '''Joomla 1.0.x''' ! allows remote attackers to execute arbitrary SQL commands via the testimID parameter in a display action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3964 | CVE-2009-3964]]
|style="background:#cef2e0; color:white" |''' [http://ninjaforge.com/index.php?option=com_ninjacentral&page=show_package&id=14&Itemid=235 developer patch Ver 1.2]'''
|-
|style="background:#cef2e0; color:black" | '''webee 1.1.1 &1.2'''
|Summary: '''webee 1.1.1,''' a Joomla commenting plugin, suffers from multiple vulnerabilities. '''webee has been updated to 1.2''' as of 12 November 2009 and''' still suffers''' from SQL Injection. XSS was not tested in 1.2. Added 19 November 2009
| [http://jeffchannell.com/Joomla/webee-111-multiple-vulnerabilities.html jeffchannell.com]
|style="background:#cef2e0; color:white" | ''' [http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/10155 developer update ver2.0]'''
|-
|style="background:#cef2e0; color:black" |'''iF Portfolio Nexus'''
|Summary: The '''iF Portfolio Nexus component for Joomla!''' is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements using the id parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. Nov 18, 2009
|[http://secunia.com/advisories/37408/ secunia.com 37408/]
|style="background:#cef2e0; color:white" |[http://www.inertialfate.za.net/help/forums/topic?id=10&p=3#p172 iF Portfolio Nexus v1.1.1 released]

|-
|style="background:red; color:white" | '''JoomClip'''
|Summary: The '''JoomClip component for Joomla!''' is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the index.php script using the cat parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. Nov 18, 2009
|[http://secunia.com/advisories/37400/ secunia.com 37400/]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Joomla XML'''
|Summary: Joomla! before 1.5.15 allows remote attackers to read an extension's XML file, and thereby obtain the extension's version number, via a direct request.
Published: 11/16/2009
|[[NIST:CVE-2009-3946 | CVE-2009-3946]]
|style="background:#cef2e0; color:white" |'''[http://developer.joomla.org/security/news/306-20091103-core-xml-file-read-issue.html Resolution]'''
|-
|style="background:red; color:white" | '''Mygallery Remote SQL Injection Vulnerability'''
|Summary: Joomla Component mygallery ( farbinform_krell) Remote SQL Injection Vulnerability Added 27 Nov 2009 {{JVer|1.5}} NB: This could be an error in our database as the only one we could find was for wordpress.If anyone know of one for joomla please let us know..(poss joomlicious.com CM)
|[http://www.exploit-db.com]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Extreme Google Calendar'''
|Summary: '''com_gcalendar 1.1.2''' (gcid) Remote SQL Injection Vulnerability
Remote SQL Injection were identified in Google Calendar Component [http://extensions.joomla.org/extensions/calendars-a-events/calendars/4188 Extension Link] Added 27 Nov 2009
|[http://www.exploit-db.com reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''LyftenBloggie'''
| Summary: [http://www.lyften.com/products/lyftenbloggie.html LyftenBloggie] Component "author" SQL Injection Vulnerability LyftenBloggie 1.x Added 27 Nov 2009
|[http://secunia.com/advisories/product/28005/ SA37499]
| [http://jeffchannell.com/Joomla/lyften-bloggie-sql-injection-fix.html Un official fix]. Developer fix not release at 30 Nov 09 ''' [http://www.lyften.com/products/lyftenbloggie/extensions/download/id-20.html 1.0.4a (last update on Dec 28, 2009)]'''
|-
|style="background:#cef2e0; color:black" |'''Sermon speaker'''
|Summary: [http://joomlacode.org/gf/project/sermon_speaker sermon speaker] sql vulnerability and password reset vulnerability version 3.2 and below
|
|style="background:#cef2e0; color:white" |[http://joomlacode.org/gf/project/sermon_speaker/forum/?action=ForumBrowse&forum_id=7897&_forum_action=ForumMessageBrowse&thread_id=15219 Developer fix] 30 Nov 2009
|-
|style="background:#cef2e0; color:white" | [http://joomlacode.org/gf/project/musicgallery/ MusicGallery]
|Summary: [http://joomlacode.org/gf/project/musicgallery/ Component MusicGallery] SQL Injection Vulnerability 30 November {{JVer|1.5}}
|[[NIST:CVE-2009-4217 | CVE-2009-4217]]
|style="background:#cef2e0; color:black" | [http://joomlacode.org/gf/project/musicgallery/ developer]
|}

----

== December 2009 Compiled Reports ==
{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''
|-
|style="background:red; color:white" | '''Omilen Photo Gallery'''
|Summary: Directory traversal vulnerability in the [http://extensions.joomla.org/extensions/photos-&-images/photo-flash-gallery/6373/details Omilen Photo Gallery] (com_omphotogallery) component Beta 0.5 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php.
Published: 12/04/2009
|[[NIST:CVE-2009-4202 | CVE-2009-4202]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Seminar'''
|Summary: SQL injection vulnerability in the [http://seminar.vollmar.ws/ Seminar] (com_seminar) component 1.28 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a View_seminar action to index.php.
Published: 12/04/2009
|[[NIST:CVE-2009-4200 | CVE-2009-4200]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Mambo Resident'''
|Summary: Multiple SQL injection vulnerabilities in the Mambo Resident (aka Mos Res or com_mosres) component 1.0f for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) property_uid parameter in a viewproperty action to index.php and the (2) regID parameter in a showregion action to index.php. Mambo Resident component for v4.5.2 '''may only be for 1.0.xx versions of J!'''
Published: 12/04/2009
|[[NIST:CVE-2009-4199 | CVE-2009-4199]]
|style="background:#cef2e0; color:white" |[http://www.jomres.net/ Replacement Extension 08 dec 09]
|-
|style="background:red; color:white" | '''ProofReader'''
|Summary: Multiple cross-site scripting (XSS) vulnerabilities in index.php in the ProofReader (com_proofreader) component 1.0 RC9 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in (1) 404 or (2) error pages. Published: 12/02/2009 CVSS Severity: 4.3 (MEDIUM)
| [[NIST:CVE-2009-4157 | CVE-2009-4157]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Laoneo Google Calendar GCalendar'''
|Summary: SQL injection vulnerability in the [http://g4j.laoneo.net/content/extensions/download/cat_view/20-joomla-15x/21-gcalendar.html Google Calendar GCalendar] (com_gcalendar) component 1.1.2, 2.1.4, and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the gcid parameter. NOTE: some of these details are obtained from third party information. Published: 11/29/2009 CVSS Severity: 7.5 (HIGH) Note: There is already a listing for GCalendar 1.1.2
|[[NIST:CVE-2009-4099 | CVE-2009-4099]]
|style="background:#cef2e0; color:white" | [http://g4j.laoneo.net/content/extensions/download/doc_details/28-gcalendar-suite-215.html Latest version GCalendar Suite 2.1.5]
|-
|style="background:red; color:white" | '''D4J eZine'''
|Summary: PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS mosConfig_absolute_path parameter. Published: 11/29/2009 CVSS Severity: 7.5 (HIGH)
|[[NIST:CVE-2009-4094 | CVE-2009-4094]]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''Quick News'''
| Summary: The Joomla [http://joomlacode.org/gf/project/quicknews/ Quick News component] suffers from a remote SQL injection vulnerability. added 1st Dec 09
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Joaktree component'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/genealogy/9842 Joaktree] Vulnerability : SQL injection/ added 1st Dec 09
|[http://securityreason.com/exploitalert/7508 7508]
|style="background:#cef2e0; color:white" | ''' [http://naastniels.nl/index.php/en/joaktree/downloads version 1.1 update]'''
|-
|style="background:red; color:white" | '''mojoblog'''
|Summary [http://www.joomlify.com/files/mojoblog/ MojoBlog] Multiple Remote File Include Vulnerability added 1st Dec 09 {{JVer|1.5}}
|[http://securityreason.com/exploitalert/7509 7509]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''YJ Whois'''
|Summary: [http://extensions.joomla.org/extensions/external-contents/domain-search/5774 YJ Whois] '''Low security risk''',and fixesMalicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. Files affected is , modules/mod_yj_whois.php added 3 December 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" |[http://www.youjoomla.com/xss-security-patch-for-yj-whois.html Developer Notice and fix 03 dec 09]
|-
|style="background:#cef2e0; color:black" | '''yt_color YOOOtheme'''
|Summary: [http://www.yootheme.com/ YT_color yootheme] Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. added 5 dec 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.yootheme.com/member-area/downloads/item/templates-15/xss-and-php-53-patches All members without an active membership can download the template patches here].'''
|-
|style="background:red; color:white" | '''TP Whois'''
|summary: [http://www.templateplazza.com/view-details/tpwhois/183-component-tp-whois-for-joomla-1.5.x.html TP Whois ] Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. Added 3 december {{JVer|1.5}}
|[http://www.exploit-db.com Refrence]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_job'''
|Summary: Component com_job ( showMoreUse) SQL injection vulnerability Added 9th Dec
|[http://xforce.iss.net/xforce/xfdb/54626 Reference]
| style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''JQuarks'''
|Summary: [http://extensions.joomla.org/extensions/contacts-and-feedback/quiz-a-surveys/10590 JQuarks] SQL injection vulnerability {{JVer|1.5}} added 8th dec 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | [http://www.iptechinside.com/labs/projects/list_files/jquarks Developer Update ]
|-
|style="background:red; color:white" | '''Mamboleto Component 2.0 RC3'''
|Summary: [http://www.fernandosoares.com.br/index.php?option=com_docman&task=cat_view&gid=28&Itemid=28 Mamboleto Component 2.0 RC3]SQL injection vulnerability {{JVer|1.5}} added 12 December
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:#cef2e0; color:black" | ''' JS JOBS'''
|Summary [http://www.joomshark.com/index.php?option=com_content&view=article&id=4&Itemid=8 JS JOBS] Joomla Component com_jsjobs 1.0.5.6 SQL Injection Vulnerabilities {{JVer|1.5}} added 12 December
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.joomsky.com/index.php?option=com_rokdownloads&view=folder&Itemid=3&id=2:components Developer update 1.0.5.7]'''
|-
|style="background:#cef2e0; color:black" | '''corePHP JPhoto'''
|Summary: [http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10365 'corePHP' JPhoto]SQL injection vulnerability {{JVer|1.5}} added 12 December
|[http://secunia.com/advisories/37676/ Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.corephp.com/blog/uber-fast-jphoto-security-release/ Developer Upgrade]'''
|-
|style="background:#cef2e0; color:black" | '''com_virtuemart'''
|Summary: "com_virtuemart" http://virtuemart.net/ '''Version : 1.0''' Vulnerability : SQL injection added Date : 07- dec -09 {{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" |[http://virtuemart.net/ latest version]
|-
|style="background:red; color:white" | ''' Kide Shoutbox'''

|Summary: The Kide Shoutbox (com_kide) component 0.4.6 for Joomla! does not properly perform authentication, which allows remote attackers to post messages with an arbitrary account name via an insertar action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Added: December 08
|[[NIST:CVE-2009-4232 | CVE-2009-4232]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | ''' JoomPortfolio Component'''
|Summary: [http://www.joomplace.com/joomportfolio/joomportfolio.html JoomPortfolio] Input passed via the "secid" parameter to index.php (when "option" is set to "com_joomportfolio" and "task" is set to "showcat") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.The vulnerability is reported in version 1.0.0. Other versions may also be affected. Added: December 18 {{JVer|1.5}}
|[http://secunia.com/advisories/37838/ Reporting Site]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''City Portal (templates?)'''
|Summary: City Portal Blind SQL Injection Vulnerability added: 2009-12-18
|[http://www.exploit-db.com Reference] Possibly this [http://www.youjoomla.com/jclick-city-portal-joomla-template.html tempate]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Event Manager'''
|Summary: [http://www.jforjoomla.com/Joomla-Components/event-manager-15-component.html Event Manager] Blind SQL Injection Vulnerability EDB-ID: 10549
added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | com_zcalendar
|Summary: com_zcalendar Blind SQL-injection Vulnerability
EDB-ID: 10548 added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_acmisc'''
|Summary: com_acmisc SQL injection added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''com_digistore'''
|Summary: com_digistore SQL injection EDB-ID: 10546 added: 2009-12-18 {{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.ijoomla.com/ijoomla-digistore/ijoomla-digistore/ijoomla-digistore-change-log/ Update change log] '''
|-
|style="background:red; color:white" | '''com_jbook'''
|Summary: com_jbook Blind SQL-injection EDB-ID: 10545 added: 2009-12-18 {{JVer|1.0}}
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_personel'''
|Summary: com_personel component for Joomla! is vulnerable to SQL injection.
|[http://xforce.iss.net/xforce/xfdb/54903 iss.net reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''JEEMA Article Collection'''
|Summary: [http://www.forum.jeema.net/component/content/article/4-jeema-article-collection-component/13-about-jeema-article-collection.html JEEMA Article Collection] Input passed via the "catid" parameter to index.php (when "option" is set to "com_jeemaarticlecollection" and "view" is set to "longlook") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. version 1.0.0.1 {{JVer|1.5}} added 22 dec 09
| [http://secunia.com/advisories/37865/ secunia]
|style="background:#cef2e0; color:white" | [http://www.jeema.net/downloads/free-joomla-extensions/joomla-components/12-jeema-joomla-article-collection.htm fixed the same in the version v102.]
|-
|style="background:red; color:white" | '''HotBrackets Tournament Brackets '''
|Summary: The [http://extensions.joomla.org/extensions/sports-a-games/sports/10746 HotBrackets Tournament Brackets] component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. {{JVer|1.5}} added 22 dec
|[http://www.securityfocus.com/bid/37439/ Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Car Manager'''
|Summary: http://webformatique.com/ com_carman Cross Site Scripting Vulnerability added 24 december 09{{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" |'''Schools component'''
|Summary: The 'com_schools' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|[http://www.securityfocus.com/bid/37469 Reference] added 24 dec 09
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''webcamxp'''
|[http://extensions.joomla.org/extensions/communication/video-conference/4490 com_webcamxp] Cross Site Scripting Vulnerabilities Last version 2008 {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''beeheard'''
|[http://extensions.joomla.org/extensions/contacts-and-feedback/testimonials-a-suggestions/10283 beeheard] Blind SQL injection Vulnerability {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://beeheard.cmstactics.com/change-log Version 1.4.2] 04 Jan'''
|-
|style="background:red; color:white" | '''jm-recommend'''
|jm-recommendCross Site Scripting Vulnerabilities. unable to locate on jed. {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | facileforms
| com_facileforms Cross Site Scripting Vulnerabilities. unable to locate on jed. Product considered retired. {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''adagency'''
| [http://www.ijoomla.com/ijoomla-ad-agency/ijoomla-ad-agency/index/ adagency ]Vulnerabilities {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_intuit'''
|[http://www.san-diego-web-designer.com/new-file-download/item/root/aboutimage-igateway-for-joomla.html com_intuit]Local File Inclusion Vulnerability {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.securityfocus.com/bid/37494/discuss Retired]'''
|-
|style="background:red; color:white" | '''MemoryBook'''
|[http://extensions.joomla.org/extensions/calendars-a-events/birthdays-a-historic-events/10868 MemoryBook 1.2] Multiple Vulnerabilities. requires: magic quotes OFF, user account {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''qpersonel'''
|[http://extensions.joomla.org/extensions/directory-a-documentation/thematic-directory/7049 qpersonel ] Cross Site Scripting Vulnerabilities {{JVer|1.0}}[[Image:http://extensions.joomla.org/images/jed/compat_15_legacy.png]] Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''opryknings point'''
|com_oprykningspoint_mc Cross Site Scripting Vulnerabilities {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''trabalhe conosco'''
|com_trabalhe_conosco Cross Site Scripting Vulnerabilities {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''DhForum'''
|com_dhforum SQL Injection Vulnerability. considered retired/EOL Dec. 27 {{JVer|1.0}}1.5 legacy
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''com_morfeoshow'''
|[http://extensions.joomla.org/extensions/photos-a-images/photo-gallery-add-ons/9810 morfeoshow] this was a false report
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:black" | ''' false report'''
|-
|style="background:#cef2e0; color:black" |'''Run Digital Download rd-download'''
|[http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7838 RD Download] Local File Disclosure Vulnerability {{JVer|1.5}} Dec. 30 Version affected not disclosed.
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7838 Version 0.9 relased]
|-
|
|
|
|
|}

----

== January 2010 Reported Vulnerable Extensions ==

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic or the [http://forum.joomla.org/viewforum.php?f=470 extensions] topic clearly marked with the first word in the title being ''Vulnerable'' where the security moderators or JSST team will respond.
''This list is change protected, for updates or editing requests [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
''

[http://docs.joomla.org/Vulnerable_Extensions_List Back To Top]

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''

|-
|style="background:#cef2e0; color:black" |JvideoDirect
|Summary: [http://extensions.joomla.org/extensions/multimedia/video-players-a-gallery/9501 Jvideodirect] SQLi Jan 29
|
|http://www.jvideodirect.com/ Update version 2.5
|style="background:red; color:white" | ''' '''
|-
|style="background:#cef2e0; color:black" |'''JEvent search plugin'''
|Summary: JEvent search plugin for [http://extensions.joomla.org/extensions/calendars-a-events/events/95 JEvent] SQLi reported Jan 29
|
|style="background:#cef2e0; color:white" | ''' [http://www.jevents.net/forum/viewtopic.php?f=17&t=3910#p15526 upgrade to 1.5.3b]'''
|
|-
|style="background:#cef2e0; color:black" |'''Kunena'''
|Summary: [http://extensions.joomla.org/extensions/communication/forum/7256/details kunena] re reported suffering SQLi in version 1.5.9 Jan 29 Confirmation Required '''Now found to be malicious'''
|
|style="background:#cef2e0; color:black" | ''' [http://www.kunena.com/blog/19-developer-blog/51-kunena-157-security-release-now-available Versions 1.5.5 and below only]'''
|
|-
|style="background:red; color:white" |'''JE Quiz'''
|Summary : http://extensions.joomla.org/extensions/contacts-and-feedback/quiz-a-surveys/11212 JeQuiz SQLi reported 29 Jan
|
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black"" |'''idoblog'''
|summary: exploitable due to open file permissions. 28 Jan
|Private Notification
|style="background:#cef2e0; color:black" | ''' [http://idojoomla.com/news.html build 35 released] '''
|-
|style="background:#cef2e0; color:black" |'''ccnewsletter'''
|Summary [http://extensions.joomla.org/extensions/5112/details ccnewsletter Directory Traversal Vulnerability] Jan 28
|Private Notification
|style="background:#cef2e0; color:white" | ''' [http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html version 1.0.6 released 29 Jan]'''
|-
|style="background:#cef2e0; color:white" |'''Virtuemart 1.1.4'''
|Summary: [http://extensions.joomla.org/extensions/e-commerce/shopping-cart/129 virtuemart] Input var order_status_id is vulnerable to SQLi NB Requires Higher Level access before exploiting. Jan 27
|
|style="background:#cef2e0; color:black" | ''' [http://forum.joomla.org/viewtopic.php?p=2027005#p2027005 developer patches]'''
|-
|style="background:#cef2e0; color:black" |'''JBDiary'''
|Summary: [http://extensions.joomla.org/extensions/calendars-a-events/events/11009 JBDiary] BLIND SQL Injection Vulnerabilities Jan 24 [http://www.jb-soft.nl/ http://www.jb-soft.nl/]
|
|style="background:#cef2e0; color:white" | ''' [http://www.jb-soft.nl/index.php?option=com_content&view=article&id=64 Developer Update 27 Jan]'''
|-
|style="background:#cef2e0; color:black" |'''JbPublishDownFp'''
|Sumary: [http://extensions.joomla.org/extensions/news-production/timed-content/6496 JbPublishDownFp] SQL Injection Vulnerability Jan 24 [http://www.jb-soft.nl http://www.jb-soft.nl]
|
|style="background:#cef2e0; color:white" |''' [http://www.jb-soft.nl/index.php?option=com_content&view=article&id=64 Developer Update Jan 27]'''
|-
|style="background:red; color:white" |'''com_casino'''
|Summary: [http://extensions.joomla.org/extensions/sports-a-games/tips-a-betts com_casino]
SQL Injection Vulnerabilities Jan24
|
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Mochigames'''
|Summary: [http://extensions.joomla.org/extensions/search/mochigames com_Mochigames]
SQL Injection Vulnerabilities Jan24
|
|style="background:#cef2e0; color:white" | ''' [http://www.yoflash.com/download.html mochigames_alpha052 Released]'''
|-
|style="background:red; color:white" |'''ContentBlogList'''
|Summary: [http://extensions.joomla.org/extensions/news-production/blog/10989 com_ContentBlogList] SQL Injection Vulnerability Jan 23
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |MailChimp for Joomla 1.5
|Summary: [http://extensions.joomla.org/extensions/bridges/mailing-a-newsletter-bridges/7836 MailChimp for Joomla 1.5] jan 17
|Developer Statement
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''JoomlaXML'''
|Summary: [http://extensions.joomla.org/extensions/tools/design-tools/5020 JoomlaXML] malicious code insertion
|
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''JVClouds3D SWF module'''
|[http://joomlapro.ru/3djvclouds JVClouds3D SWF module] Cross Site Scripting . jan 14
|[http://xforce.iss.net/xforce/xfdb/55535 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''JVClouds3D'''
|[http://joomlapro.ru/3djvclouds JVClouds3D module] Cross Site Scripting . jan 14
|[http://xforce.iss.net/xforce/xfdb/55534 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''JA Showcase'''
|[http://www.joomlart.com/addons/components_and_modules/ja_showcase.html JA Showcase component] Directory Traversal jan 14
|[http://xforce.iss.net/xforce/xfdb/55512 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''jprojects'''
|Summary: Unknown Author com_j-projects Blind SQL Injection Vulnerability. Jan 10 detail update
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''jEmbed-Embed Anything'''
|[http://www.joshprakash.com/index.php?option=com_docman&task=doc_details&gid=70 jEmbed-Embed Anything] A vulnerability has been discovered in the jEmbed-Embed Anything component for Joomla, which can be exploited by malicious people to conduct SQL injection attacks. Jan 10
|[http://secunia.com/advisories/38112 Secunia Advisory: SA38112]
|style="background:red; color:white" | [http://extensions.joomla.org/extensions/3699/details Product considered retired]
|-
|style="background:#cef2e0; color:black" |'''perchagallery '''
|Summary: perchagallery [http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10350 com_perchagallery] SQL Injection Vulnerability Jan 7
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.percha.com/index.php?option=com_phocadownload&view=file&id=22:1.5&Itemid=20 Developer Update 1.5b]'''
|-
|style="background:#cef2e0; color:black" | '''CARTwebERP'''
|Summary: [http://extensions.joomla.org/extensions/bridges/e-commerce-bridges/8753 CARTwebERP] Local File Inclusion Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://extensions.joomla.org/extensions/bridges/e-commerce-bridges/8753 1.56.76 (last update on Jan 11, 2010)]'''
|-
|style="background:#cef2e0; color:black" | '''JoomlaBibleStudy'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/religion/3461 JoomlaBibleStudy] LFI Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | '''[http://joomlabiblestudy.org/invisible-downloads/category/3-component.html Developer reported update]'''
|-
|style="background:#cef2e0; color:black" | '''com_bfsurvey_basic and pro'''
|Summary: [http://www.tamlyncreative.com.au/software/ BFsurvey] SQL Injection Vulnerability ,LFI Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.tamlyncreative.com.au/software/forum/index.php?topic=641.0 Developer Update announcement]'''
|-
|style="background:red; color:white" | '''Alfresco'''
|Summary: SQL Injection Vulnerability. Not believed to be Joomlatools extension Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''abbrev'''
|Summary: [http://extensions.joomla.org/extensions/directory-a-documentation/glossary-a-dictionary/4965 abbrev] Local File Inclusion Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''countries'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/development/6553 countries] SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Dedicated Component com_tpjobs'''
|Summary: [http://www.templateplazza.com/ tpjobs] SQL Injection Vulnerability unable to locate files probably template plaza Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.templateplazza.com/extensions-updates/tpjobs-component-update-v-1.1.html Developer Update] '''
|-
|style="background:red; color:white" | '''Component com_doqment'''
|SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Component com_otzivi'''
|Blind SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''aprice'''
|Summary: [http://adeptweb.info/component/option,com_aprice/Itemid,109/ com_aprice] Component 'analog' Parameter SQL Injection Vulnerability
|[http://www.securityfocus.com/bid/37575 Report]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''cartikads'''
|Summary: [http://www.cartikahosting.com com_cartikads] Remote File Upload Vulnerability
'''Mambo''' Open Source ads management component
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Docman seller'''
|Summary: [http://extensions.joomla.org/extensions/e-commerce/subscriptions/5000 Document seller] Input passed via the "id" parameter to index.php (when "option" is set to "com_dm_orders", "task" is set to "order_form", and "payment_method" is set to "Paypal") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
|[http://secunia.com/advisories/38024/ secunia]
|style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/e-commerce/subscriptions/5000 Updated 10th Jan]
|-
|style="background:#cef2e0; color:black" | '''ozio gallery'''
|summary: [http://extensions.joomla.org/extensions/photos-a-images/photo-flash-gallery/4883 Ozio Gallery2] SQLi eploit
|[http://www.viruslist.com/en/advisories/37974 Reference]
|style="background:#cef2e0; color:white" |[http://oziogallery.joomla.it/index.php?option=com_content&view=article&id=62%3Anuova-ozio-gallery-23-aggiornamento-di-sicurezza&catid=2%3Anotizie&Itemid=13&lang=en developer update Jan 11]
|-
|style="background:#cef2e0; color:black" | '''RD-Autos Free'''
|[http://extensions.joomla.org/extensions/vertical-markets/vehicles/5458 RD-Autos Free ] This version is now commercial not free
|Private advisory to JED Jan 11
|style="background:red; color:white" | ''' Product Retired and replaced'''
|-
|style="background:red; color:white" | '''DailyMeals'''
|Summary: [http://extensions.joomla.org/extensions/vertical-markets/food-a-beverage/4764 dailymeals] Local File Inclusion Vulnerability Jan 02
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''RD-Autos Pro'''
|[http://extensions.joomla.org/extensions/vertical-markets/vehicles/6357 RD Autos Pro]
|Private advisory to JED Jan 11
|style="background:#cef2e0; color:black" | ''' Upgrade to Latest version be 2.0.2'''
|-
|
|
|
|
|}

== New format Feed Starts Here ==
Please do not change your [http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions feed url], only the feed format has changed.

== February, March, April, May 2010 Reported Vulnerable Extensions ==
<startFeed />

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic clearly marked with the first word in the title being ''Vulnerable Report'' where the security moderators or JSST team will respond. For a guide to the [http://docs.joomla.org/Vulnerable_Extensions_List_0210#Codes_used codes]

[http://docs.joomla.org/Vulnerable_Extensions_List Previous Reports]

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Date Added'''
! class="unsortable" |'''Extension Update Link & Date'''
|-
|style="background:red; color:white" |

== JE Poll ==
|http://slideshow.joomlaextensions.co.in/ SQL Injection Vulnerability
|
|
|-
|style="background:red; color:white" |

== MyCar ==
|http://www.unisoft.me/extensions/ sqli ID
|
|
|-
|style="background:red; color:white" |

== MediQnA ==
|MediQnA LFI vulnerability version : v1.1
|
|
|-
|style="background:red; color:white" |

== JE Job ==
|http://joomlaextensions.co.in/ LFI SQLi
|
|
|-
|style="background:#cef2e0; color:black"|

== BF Quiz ==
|SQL Injection Exploit Version(s) = 1.3.0
|
|[http://www.tamlyncreative.com.au/software/forum/index.php?topic=729.0 Developer update to BF Quiz v1.3.1]
|-
|

== ==
|
|
|
|-
|style="background:#cef2e0; color:black"|

== Ozio Gallery 2 ==
|DT and open email relay
|280510
|[http://oziogallery.joomla.it/index.php?option=com_content&view=article&id=65:rilasciata-la-versione-ozio-gallery-25&catid=2:notizie&Itemid=13&lang=en Developer update and security release] 010610
|-
|style="background:red; color:white" |

== SectionEx ==
|Stack Ideas section Ex LFI
|
|
|-
|style="background:red; color:white" |

== ActiveHelper LiveHelp ==
|XSS in [http://extensions.joomla.org/extensions/communication/chat/12492 LiveHelp]
|200510
|
|-
|style="background:#cef2e0; color:black"|
== RS Comments ==
|XSS Vulnerability
|
|http://www.rsjoomla.com/customer-support/documentations/96--general-overview-of-the-component/393-changelog.html - fix posted 210510
|-
|style="background:red; color:white" |

== BCA RSS Feed ==
|LFI and other vulnerabilities
|
|Since changed its name to NinjaRss
|-
|

== SimpleDownload ==
|http://extensions.joomla.org/extensions/directory-a-documentation/downloads/10717 various exploits
|160510
|updated version (version 0.9.6)
|-
|style="background:red; color:white" |
== JE Quotation Form ==
|http://joomlaextensions.co.in/free-download/doc_download/11-je-quotation-form.html LFI
|
|
|-
|style="background:red; color:white" |

== konsultasi ==
|SQL Injection Vulnerability
|
|
|-
|style="background:red; color:white" |

== Aardvertiser ==
|Local File Inclusion Vulnerability
http://extensions.joomla.org/extensions/ads-a-affiliates/classified-ads/9454
|
|
|-
|style="background:red; color:white" |

== Seber Cart ==
|Local File Disclosure Vulnerability
|
|[http://www.sebercart.com/index.php?option=com_content&view=article&id=158 Developer Update 140510]
|-
| style="background:#cef2e0; color:black"|

== FDione Form Wizard ==
|lfi vulnerability
|140510 200510
|[dionesoft.com Update to Dione Form Wizard (v. 1.0.4)].
|-
| style="background:#cef2e0; color:black"|

== Custom PHP Pages ==
|http://extensions.joomla.org/extensions/edition/custom-code-in-content/5057 LFI Vulnerability
|
|[fijiwebdesign.com Developer declares not vulnerable 140510]
|-
|style="background:red; color:white" |

== Camp26 Visitor ==
|RFI www.camp26.biz
|
|
|-
|style="background:#cef2e0; color:black"|

== iJoomla News Portal ==
|RFI SID
|
|[http://www.ijoomla.com/forum/index.php/topic,4480.0.html Update to 1.5.10]
|-
| |

== article Factory Manager ==
|RFI & Input Validation Error http://www.thefactory.ro/shop/joomla-components/article-manager.html
|may 2010
|can not reproduce and unproven, http://www.thefactory.ro
|-
|style="background:red; color:white" |

== Table JX Component ==
|http://www.toolsjx.com/ Table JX Component XSS
|060510 - update 130510
|Version: 1.5.5 considered unsafe
|-
|style="background:red; color:white" |

== JE Property ==
|JE Property Finder Upload Vulnerability
|
|
|-
|style="background:red; color:white" |

== Noticeboard ==
|Noticeboard for Joomla "controller" Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

==SmartSite ==
|SmartSite com_smartsite Local File Inclusion Vulnerability
|
|
|-
|style="background:#cef2e0; color:black" |

== ABC ==
|ABC SQL Injection Vulnerability
|
|reported as updated to JED 290410
|-
|style="background:red; color:white" |

== htmlcoderhelper graphics ==
|htmlcoderhelper graphics v1.0.6 LFI Vulnerability
|
|
|-
|style="background:red; color:white" |

== Ultimate Portfolio ==
|Ultimate Portfolio Local File Inclusion Vulnerability
|
|
|-
|style="background:#cef2e0; color:black" |

== huruhelpdesk ==
|http://www.huruhelpdesk.net sqli injection
|
|[http://www.huruhelpdesk.net/forums/8-announcements/392--sql-injection-reveals-user-md5-password-hash Reported fix]
|-
|style="background:red; color:white" |

== Archery Scores ==
| [http://lispeltuut.org/ Archery Scores (com_archeryscores) v1.0.6 LFI Vulnerability]

|210410
|
|-
|style="background:red; color:white" |

== ZiMB Manager ==
|Joomla Component ZiMB Manager Local File Inclusion Vulnerability
|210410
|
|-
|style="background:red; color:white" |

== Matamko ==
|Matamko Local File Inclusion Vulnerability
|210410
|
|-
|style="background:red; color:white" |

== Multiple Root ==
|Multiple Root Local File Inclusion Vulnerability http://joomlacomponent.inetlanka.com/
|
|
|-
|style="background:red; color:white" |

== Multiple Map ==
|Multiple Map Local File Inclusion Vulnerability joomlacomponent.inetlanka.com
|
|
|-
|style="background:red; color:white" |

== Contact Us Draw Root Map ==
|Draw Root Map Local File Inclusion Vulnerability joomlacomponent.inetlanka.com
|
|
|-
|style="background:red; color:white" |

== iF surfALERT ==
|[http://www.inertialfate.za.net/ iF surfALERT] Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

== GBU FACEBOOK ==
|GBU FACEBOOK SQL injection vulnerability http://www.gbugrafici.nl/gbufacebook/
|
|
|-
|style="background:red; color:white" |

== jnewspaper ==
|jnewspaper (cid) SQL Injection Vulnerability
|
|
|-
|style="background:#cef2e0; color:black"|

== JTM Reseller ==
|TM Reseller SQL injection vulnerability
|
|[http://jtmreseller.com/ Developer Update]
|-
|style="background:#cef2e0; color:black" |

== media Mall Factory ==
|SQLi
|200410
| [http://www.thefactory.ro/contact-us/product-update-request.html Solution: update to 1.0.5]

|-
|style="background:#cef2e0; color:black"|

== Gadget Factory ==
|LFi
|200410
|[http://www.thefactory.ro/contact-us/product-update-request.html Solution: update to 1.5.1]
|-
|style="background:#cef2e0; color:black"|

== Deluxe Blog Factory ==
|SQLi
|200410
|[http://www.thefactory.ro/contact-us/product-update-request.html update to 1.1.2]
|-
|

== ==
|
|
|-
|style="background:red; color:white" |
== MT Fire Eagle ==

|LFI http://joomlacode.org/gf/project/jfireeagle/frs/ http://www.moto-treks.com
| 190410
| product considered retired and to be replaced by dev
|-

|

== com properties ==
| http://com-property.com/ SQL I
|
|[http://www.com-property.com/images/fbfiles/files/properties-20100413.txt developer announced fix]
|-
|style="background:red; color:white"|

== Sweetykeeper ==
|Sweetykeeper Local File Inclusion Vulnerability http://www.joomlacorner.com/
|120410
|
|-
|style="background:red; color:white"|

== jvehicles ==
|SQL Injection http://jvehicles.com
|120410
|
|-
|style="background:red; color:white"|

== worldrates ==
|http://dev.pucit.edu.pk/
|120410
|
|-
|style="background:red; color:white"|

== cvmaker ==
|http://dev.pucit.edu.pk/
|
|
|-
|style="background:red; color:white"|

== advertising ==
|http://dev.pucit.edu.pk/
|
|
|-
|style="background:red; color:white"|

== horoscope ==
|http://dev.pucit.edu.pk/
|120410
|
|-
|style="background:red; color:white"|

== webtv ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:red; color:white"|

== diary ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:#cef2e0; color:black"|

== Multi-Venue Restaurant Menu Manager (MVRMM) ==
|http://www.focusdev.co.uk/
|120410
||[http://extensions.joomla.org/extensions/vertical-markets/food-a-beverage/10015 Version 1.5.2 Stable Update 4]
|-
|style="background:red; color:white"|

== Memory Book ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:red; color:white"|

== TRAVELbook ==
| http://www.demo-page.de/
|120410
|-
|style="background:#cef2e0; color:black"|

== AlphaUserPoints ==
|
|[http://www.alphaplug.com/index.php/downloads.html?func=fileinfo&id=31 developer upgrade]

|-
|style="background:red; color:white"|

== JprojectMan ==
|LFI http://extensions.joomla.org/extensions/communities-a-groupware/project-a-task-management/5676
|110410
|-
|style="background:#cef2e0; color:black"|

== CKForms ==
|1.3.4 release - Important LFI security fix [http://joomlacode.org/gf/project/ckforms/news/?action=NewsThreadView&id=2814 ]
|07-04-10
|[http://ckforms.cookex.eu/download/download.php upgrade]
|-
|style="background:red; color:white"|

== econtentsite ==
|LFI
|040410
|-
|style="background:red; color:white"|

== Jvehicles ==
|ID
|040410
|-
|

== ==
|
|
|-
|style="background:#cef2e0; color:black"|

== smestorage ==
|[http://www.smestorage.com SMEStorage] LFI

|Updated 29 March 10
|[http://gelembjuk.com/index.php?option=com_content&view=section&layout=blog&id=1&Itemid=55 developer fix] to 1.1
|-
|style="background:#cef2e0; color:black"|

== JE Tooltip ==
|[http://joomlaextensions.co.in/formcreator/ JE Tooltip] LFI
|Updated 23 March
|-
|style="background:#cef2e0; color:black"|

== Gift Exchange Beta ==
|[http://extensions.joomla.org/extensions/communities-a-groupware/membership/11680 Gift exchange] SQLi
|Updated 23 March
|[http://socialables.com/28-Jomsocial/Gift-Exchange/flypage.tpl.html upgrade beta 1.0.1]

|-
|style="background:#cef2e0; color:black"|

== RokDownloads ==
|[[http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7967 LFI]]
|15 march 2010
||upgrade to [http://www.rockettheme.com/extensions-updates/638-rokdownloads-10-released version 1.0]
|-
|style="background:red; color:white"|

== gigcalender ==

|SQLi [http://extensions.joomla.org/extensions/calendars-a-events/events/97)http://extensions.joomla.org/extensions/calendars-a-events/events/97 gigcalender]
|13 march 2010
|
|-
|style="background:red; color:white"|

== heza content ==
|SQLi [http://extensions.joomla.org/extensions/structure-a-navigation/sections-a-categories/10427)http://extensions.joomla.org/extensions/structure-a-navigation/sections-a-categories/10427 heza content]
|13 march 2010
|
|-
|style="background:red; color:white"|

== juliaportfolio ==
|LFI [http://extensions.joomla.org/extensions/directory-&-documentation/portfolio/8519/details juliaportfolio]
|13 march 2010
|
|-

|style="background:#cef2e0; color:black" |

== Flash Magazine Deluxe ==
|SQL Injection Vulnerability.
|Feb 25
|'''[http://www.joomplace.com/flash-magazine-deluxe/flash-magazine-deluxe-description.html Developer Update Version 2.0.11 09/03/10]'''
|-
|style="background:red; color:white" |

== SqlReport ==
|Sqlreport has a sql/RFI exploit. awaiting confirmation on exact developer.
|Feb 20
|'''Not Known'''
|-
|style="background:#cef2e0; color:black" |

== Scriptegrator ==
|Core Design [http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html Scriptegrator] RFI exploit
|Feb 20
|[http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html Dev Upgrade announcement]
|-
|style="background:#cef2e0; color:black" |

== AllVideos 3.1 ==
|
A vulnerability discovered in versions 3.0. and 3.1 of the plugin can be exploited by malicious people to disclose potentially sensitive information. For security reasons we will not be providing further details to safeguard users of affected versions. http://www.joomlaworks.gr/content/view/77/34/]|
|17 Feb
| [http://joomlaworks.googlecode.com/files/plg_jw_allvideos-v3.3_j1.5.zip Version 3.3 release 18th]
|-
|style="background:#cef2e0; color:black" |

== RW Cards ==
| [http://extensions.joomla.org/extensions/3430/details RW Card] LFI and ID exploit [http://www.weberr.de/ Dev Site]
|180210
|style="background:#cef2e0; color:black" |''' [http://www.weberr.de/index.php/forum.html?func=view&catid=5&id=1939&limit=6 developer update]'''
|-
|style="background:red; color:white" |

== Yelp ==
| SQLi - Unable to locate developer. Possibly a custom extension.
|Feb 01
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |

== '''Autartitarot''' ==
|Directory Traversal. Back end access required
| Feb 05
|style="background:#cef2e0; color:black" | ''' Please upgrade to [http://www.autartica.be/en/autartitarot version 1.0.4]'''
|-
|style="background:#cef2e0; color:black" |

== communitypolls ==
|LFI - [http://www.corejoomla.com/ community polls]
|Feb 17
||upgrade to [http://www.corejoomla.com/ version 1.5.3]
|-
|

== ==
|
|
|
|}
<endFeed />

''This list is change protected, for updates or additions [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
''

== Codes used ==
SQLi - SQL injection [http://en.wikipedia.org/wiki/Code_injection#SQL_injection wikipedia]

LFI - Local File Inclusion [http://www.scribd.com/doc/6498408/Remote-and-Local-File-Inclusion-Explained scribd]

RFI - Remote file inclusion [http://en.wikipedia.org/wiki/Remote_File_Inclusion wikipedia]

DT - Directory Traversal [http://en.wikipedia.org/wiki/Directory_traversal wikipedia]

ID = Information Disclosure: account information or sensitive information publicly viewable

== Developers - How to get yourself removed from the VEL ==

Resolved items will be removed after a suitable period and not on resolution

Please solve the issues and:

* If JED listed
Attach the new zip file at your actual JED listing.

Change the extension version at JED listing.

Contact the JED by mail back with a notice and ask them republish your listing.

* If not JED listed.
Inform us by PM of the link to your resolution notice on your website.

== Future Actions & WIP ==

[http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions RSS feed] completed

to feed VEL direct to twitter

== Notes ==
The RSS feed is currently fed by item entry order and not by date fixed.
List as discussed in [[jtopic:455746]] by [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=67439 PhilD] editing by [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville]

----
[[Category:Security]]
[[Category:Security_FAQ]]

----

Archived:Vulnerable Extensions List

2010-06-03T08:29:53Z

Hidabe:

{{RightTOC}}
== Check and Report. ==

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic or the [http://forum.joomla.org/viewforum.php?f=470 extensions] topic clearly marked with the first word in the title being ''Vulnerable'' where the security moderators or JSST team will respond.
This list is change protected, for updates or editing requests [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
*If you are seeing this page on any site other than [http://docs.joomla.org/Vulnerable_Extensions_List the Offical Joomla Documentation] you may be seeing an out of date version or experiencing [http://en.wikipedia.org/wiki/Plagiarism plagiary] and the links may not work properly

== How to use this list ==
'''Items will be removed after a suitable period and not on resolution'''
All known vulnerable extensions are the listed in the first column. Any in a red box are high where we have not been given a fix for. Alert Advisory details in the centre column (the date is in American format mm/dd/yyyy).
The link to the advisory notice.
Finally a link to the notice about any update with link or '''Not Known''' where none is known.

'''This list is compiled from found information and may not be an up to date accurate list''' ''We do '''NOT''' promise to test or validate these reports. We do '''NOT''' guarantee the quality or effectiveness of any updates reported to us or listed here.''
To sign up for the feed please [http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions follow this link]

== November 2009 Compiled Vulnerability Reports. ==

Items are not in any particular order.

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''
|-
| style="background:#cef2e0; color:black" | '''com_ajaxchat'''
| Summary: PHP remote file inclusion vulnerability in Fiji Web Design Ajax Chat ('''com_ajaxchat''') component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter to tests/ajcuser.php.New version release December 22,2009
Published: october 28 2009
| [[NIST:CVE-2009-3822|CVE-2009-3822]]
| style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/communication/chat/10767 update v 1.1]
|-
| style="background:#cef2e0; color:black" | '''com_booklibrary'''
| PHP remote file inclusion vulnerability in doc/releasenote.php in the BookLibrary ('''com_booklibrary''') component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter, a different vector than [[NIST:CVE-2009-2637|CVE-2009-2637]]. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 10/28/2009
CVSS Severity: 7.5 (HIGH)
| [[NIST:CVE-2009-3817|CVE-2009-3817]]
| style="background:#cef2e0; color:black" | '''[http://ordasoft.com/Download/Joomla1.0-extensions/Joomla1.0-components/View-category.html developer site updates]'''
|-
| style="background:#cef2e0; color:black" | '''com_foobla_suggestions'''
| Summary: SQL injection vulnerability in the foobla Suggestions ('''com_foobla_suggestions''') component 1.5.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the idea_id parameter to index.php.
Published: 10/11/2009
CVSS Severity: 7.5 (HIGH)
| [[NIST:CVE-2009-3669|CVE-2009-3669]]
| style="background:#cef2e0; color:white" | [http://foobla.com/news/latest/fixed-foobla-suggestions-for-joomla-idea_id-sql-injection-vulnerability.html developer reported upgrade]
|-
| style="background:red; color:white" | '''com_djcatalog'''
| Summary: Multiple SQL injection vulnerabilities in the DJ-Catalog ('''com_djcatalog''') component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a showItem action and (2) cid parameter in a show action to index.php.
Published: 10/11/2009
CVSS Severity: 6.8 (MEDIUM)
| [[NIST:CVE-2009-3661|CVE-2009-3661]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_cbresumebuilder'''
| Summary: SQL injection vulnerability in the JoomlaCache CB Resume Builder (''''''com_cbresumebuilder''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a group_members action to index.php.
Published: 10/09/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3645|CVE-2009-3645]]
| style="background:#cef2e0; color:white" |'''[http://www.joomlacache.com/commercial-extensions/security-update.html Developer Update]'''
|-
| style="background:red; color:white" | '''com_soundset'''
| Summary: SQL injection vulnerability in the Soundset ('''com_soundset''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php.
Published: 10/09/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3644|CVE-2009-3644]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" |'''com_sportfusion'''
| Summary: SQL injection vulnerability in the Kinfusion SportFusion ('''com_sportfusion''') component 0.2.2 through 0.2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a teamdetail action to index.php.
Published: 09/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3491|CVE-2009-3491]]
| style="background:red; color:white" |'''Not Known'''
|-
| style="background:red; color:white" | '''com_icrmbasic'''
| Summary: A certain interface in the iCRM Basic ('''com_icrmbasic''') component 1.4.2.31 for Joomla! does not require administrative authentication, which has unspecified impact and remote attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 09/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3481|CVE-2009-3481]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_mytube'''
| Summary: SQL injection vulnerability in the MyRemote Video Gallery ('''com_mytube''') component 1.0 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter in a videos action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3446|CVE-2009-3446]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_fastball'''
| Summary: SQL injection vulnerability in the Fastball ('''com_fastball''') component 1.1.0 through 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the league parameter to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3443|CVE-2009-3443]]
| style="background:#cef2e0; color:white" | [http://www.fastballproductions.com latest version] 1.2.1
|-
| style="background:red; color:white" | '''com_facebook'''
| Summary: SQL injection vulnerability in the JoomlaFacebook ('''com_facebook''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a student action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3438|CVE-2009-3438]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_tupinambis'''
| Summary: SQL injection vulnerability in the Tupinambis ('''com_tupinambis''') component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the proyecto parameter in a verproyecto action to index.php.
Published: 09/28/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3434|CVE-2009-3434]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''com_idoblog'''
| Summary: SQL injection vulnerability in the IDoBlog ('''com_idoblog''') component 1.1 build 30 for Joomla! allows remote attackers to execute arbitrary SQL commands via the userid parameter in a profile action to index.php, a different vector than [[NIST:CVE-2008-2627|CVE-2008-2627]].
Published: 09/25/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3417|CVE-2009-3417]]
| style="background:#cef2e0; color:white" |'''[http://idojoomla.com/download.html/ '''New Version v 1.1''' (build 32)]'''
|-
| style="background:red; color:white" | '''com_hbssearch'''
| Summary: Cross-site scripting ('''XSS''') vulnerability in the Hotel Booking Reservation System ('''aka HBS or com_hbssearch''') component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the adult parameter in a showhoteldetails action to index.php.
Published: 09/24/2009
CVSS Severity: 4.3 ('''MEDIUM''')
| [[NIST:CVE-2009-3368|CVE-2009-3368]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_hbssearch'''
| Summary: Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System ('''aka HBS or com_hbssearch''') component for Joomla! allow remote attackers to execute arbitrary SQL commands via the ('''1''') h_id, ('''2''') id, and ('''3''') rid parameters to longDesc.php, and the h_id parameter to ('''4''') detail.php, ('''5''') detail1.php, ('''6''') detail2.php, ('''7''') detail3.php, ('''8''') detail4.php, ('''9''') detail5.php, ('''10''') detail6.php, ('''11''') detail7.php, and ('''12''') detail8.php, different vectors than [[NIST:CVE-2008-5865|CVE-2008-5865]], [[NIST:CVE-2008-5874|CVE-2008-5874]], and [[NIST:CVE-2008-5875|CVE-2008-5875]].
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3357|CVE-2009-3357]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''com_alphauserpoints'''
| Summary: SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints ('''com_alphauserpoints''') component 1.5.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the username2points parameter.
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3342|CVE-2009-3342]]
| style="background:#cef2e0; color:white" |'''[http://www.alphaplug.com/index.php/news/142-alphauserpoints-153-released.html 1.5.3]'''
|-
| style="background:red; color:white" | '''TurtuShout'''
| Summary: SQL injection vulnerability in the TurtuShout component 0.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Name field.
Published: 09/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3335|CVE-2009-3335]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_jinc'''
| Summary: SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component ('''aka JINC or com_jinc''') component 0.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a messages action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3334|CVE-2009-3334]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_jbudgetsmagic'''
| Summary: SQL injection vulnerability in the JBudgetsMagic ('''com_jbudgetsmagic''') component 0.3.2 through 0.4.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the bid parameter in a mybudget action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3332|CVE-2009-3332]]
| style="background:red; color:white" | '''[http://sopinet.com/jbudgetsmagic/index.php?option=com_remository&Itemid=5&lang=en Update to 0.4.1]'''
|-
| style="background:red; color:white" | '''com_surveymanager'''
| Summary: SQL injection vulnerability in the Focusplus Developments Survey Manager ('''com_surveymanager''') component 1.5.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the stype parameter in an editsurvey action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3325|CVE-2009-3325]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_album'''
| Summary: Directory traversal vulnerability in the Roland Breedveld Album ('''com_album''') component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. ('''dot dot''') in the target parameter to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3318|CVE-2009-3318]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_jreservation'''
| Summary: SQL injection vulnerability in the [http://extensions.joomla.org/extensions/vertical-markets/booking-a-reservation/9798 JReservation] ('''com_jreservation''') component 1.0 and 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a propertycpanel action to index.php.
Published: 09/23/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3316|CVE-2009-3316]]
| style="background:#cef2e0; color:black" | [http://www.jforjoomla.com Updated 28th] Jan fixed 13th Nov
|-
| style="background:red; color:white" | '''IXXO Cart Standalone'''
| Summary: SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, and the IXXO Cart component for Joomla! 1.0.x, allows remote attackers to execute arbitrary SQL commands via the parent parameter.
Published: 09/16/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3215|CVE-2009-3215]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_digifolio'''
| Summary: SQL injection vulnerability in the DigiFolio ('''com_digifolio''') component 1.52 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a project action to index.php.
Published: 09/15/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3193|CVE-2009-3193]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_aclassf'''
| Summary: Cross-site scripting ('''XSS''') vulnerability in '''gmap.php''' in the Almond Classifieds ('''com_aclassf''') component 7.5 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the addr parameter.
Published: 09/10/2009
CVSS Severity: 4.3 ('''MEDIUM''')
| [[NIST:CVE-2009-3155|CVE-2009-3155]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_aclassf'''
| Summary: SQL injection vulnerability in the Almond Classifieds ('''com_aclassf''') component 7.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action to index.php, a different vector than [[NIST:CVE-2009-2567|CVE-2009-2567]].
Published: 09/10/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3154|CVE-2009-3154]]
| style="background:#cef2e0; color:white" | [http://www.almondsoft.com/alcl.html Developer latest component]
|-
| style="background:red; color:white" | '''com_jabode'''
| Summary: SQL injection vulnerability in Jabode horoscope extension ('''com_jabode''') for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.
Published: 09/08/2009
CVSS Severity: 7.5 ('''HIGH''')

| [[NIST:CVE-2008-7169|CVE-2008-7169]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_gameserver'''
| Summary: SQL injection vulnerability in the Game Server ('''com_gameserver''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a gamepanel action to index.php.
Published: 09/03/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3063|CVE-2009-3063]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_artportal'''
| Summary: SQL injection vulnerability in the Artetics.com Art Portal ('''com_artportal''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the portalid parameter to index.php.
Published: 09/03/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-3054|CVE-2009-3054]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" | '''com_agora'''
| Summary: Directory traversal vulnerability in the Agora ('''com_agora''') component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.
Published: 09/03/2009
CVSS Severity: 6.8 ('''MEDIUM''')
| [[NIST:CVE-2009-3053|CVE-2009-3053]]
| style="background:#cef2e0; color:white" |'''[http://jvitals.com/index.php?option=com_rokdownloads&view=file&Itemid=108&id=282:agora-3-0 3.0.7]'''
|-
| style="background:red; color:white" | '''com_simpleshop'''
| Summary: SQL injection vulnerability in the Simple Shop Galore ('''com_simpleshop''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the section parameter in a section action to index.php, a different vulnerability than [[NIST:CVE-2008-2568|CVE-2008-2568]]. NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
Published: 08/24/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-7033|CVE-2008-7033]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_groups'''
| Summary: SQL injection vulnerability in the Permis ('''com_groups''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a list action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 08/17/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2009-2789|CVE-2009-2789]]
| style="background:red; color:white" | '''Not Known'''

|-
| style="background:#cef2e0; color:black" | '''com_content'''
| Summary: SQL injection vulnerability in the content component ('''com_content''') 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a blogcategory action to index.php.
Published: 08/10/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6923|CVE-2008-6923]]
| style="background:#cef2e0; color:white" |'''[http://developer.joomla.org/security/news/305-20091103-core-front-end-editor-issue-.html Resolution]'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: SQL injection vulnerability in the Live Chat ('''com_livechat''') component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the last parameter to getChatRoom.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6883|CVE-2008-6883]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: Live Chat ('''com_livechat''') component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6882|CVE-2008-6882]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:red; color:white" | '''com_livechat'''
| Summary: Multiple SQL injection vulnerabilities in the Live Chat ('''com_livechat''') component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the last parameter to ('''1''') getChat.php, ('''2''') getChatRoom.php, and ('''3''') getSavedChatRooms.php.
Published: 07/30/2009
CVSS Severity: 7.5 ('''HIGH''')
| [[NIST:CVE-2008-6881|CVE-2008-6881]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''JUMI'''
| There is a backdoor in JUMI that installs itself when JUMI is installed on your web site. It sends your credentials to a website, and sets up a back door for remote code execution.
Please remove JUMI2.0.5 immediately.
It will be simple enough to remove the compromised code from this download, but you need to do
a full security audit on your site as well as you have been compromised. Added November 2009
| [http://code.google.com/p/jumi/updates/list Report]
| style="background:#cef2e0; color:white" |[http://code.google.com/p/jumi/updates/list Jumi Update]
|-
| style="background:#cef2e0; color:black" |'''com_photoblog'''
| Input Validation Error Added November 2009
| [http://www.securityfocus.com/bid/36809/ 36809]
| style="background:#cef2e0; color:white" |[http://webguerilla.net/downloads/3-components-for-joomla-1 webguerilla Photoblog alpha 3b]
|-
| style="background:red; color:white" | '''com_jshop'''
| Summary: SQL injection vulnerability in the JShop ('''com_jshop''') component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a product action to index.php.
Published: 11/02/2009
CVSS Severity: 7.5 '''(HIGH)'''
| [[NIST:CVE-2009-3835|CVE-2009-3835]]
| style="background:red; color:white" | '''Not Known'''
|-
| style="background:#cef2e0; color:black" |'''BF Survey Pro'''
| Summary: SQL injection vulnerability in the '''BF Survey Pro''' v1.2.5 or lower (fixed in version 1.2.6). '''BF Survey Basic v1.0''' (fixed in version 1.1). '''BF Quiz v1.1.1''' (fixed in version 1.2 or greater) Added November 2009
| [http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.0 tamlyncreative.com.au]
| style="background:#cef2e0; color:white" |[http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.0 update]
|-
| style="background:#cef2e0; color:black" |'''Joo!BB 0.9.1 '''
| Summary: Persistent XSS/MySQL Injection vulnerabilities in Joo!BB 0.9.1 Added November 2009
| [http://www.joobb.org/community/board/topic/700-MultipleXSSSQLInjectionVulnerabilities.html joob.org]
| style="background:#cef2e0; color:white" |[http://www.joobb.org/downloads/components.html update]
|-
| style="background:#cef2e0; color:black" |'''sh404sef '''
| Summary: sh404sef URI XSS Vulnerability Added November 2009
| [http://jeffchannell.com/Joomla/sh404sef-uri-xss-vulnerability.html jeffchannell.com]
| style="background:#cef2e0; color:white" |[http://extensions.siliana.com/en/2009060876/sh404SEF-and-url-rewriting/Interim-release-of-sh404sef-for-Joomla-1.5.x.html update]
|-
| style="background:#cef2e0; color:black" | '''AWD Wall 1.5'''
| Summary '''AWD Wall 1.5''' Blind SQL Injection Vulnerability.The Joomla component AWD Wall 1.5 suffers from an SQL Injection vulnerability in its handling of the 'cbuser' parameter.Added November 2009
| [http://jeffchannell.com/Joomla/awd-wall-15-blind-sql-injection-vulnerability.html Notice]
|style="background:#cef2e0; color:white" | '''[http://www.awdsolution.com/template_demo/testsite/index.php?option=com_content&view=article&id=48&Itemid=72 developer update]'''
|-
| style="background:red; color:white" | '''EasyBook 2.0.0rc4'''
| Summary: The Joomla component '''EasyBook 2.0.0rc4''' suffers from multiple persistent XSS vulnerabilities. One seems fairly critical, while the others would take some incredible creativity to actively exploit. Added November 2009
| [http://jeffchannell.com/Joomla/easybook-200rc4-multiple-xss-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''F!BB 1.5.96'''
| Summary: The Joomla component '''F!BB 1.5.96 RC''' suffers from multiple persistent XSS vulnerabilities, as well SQL Injection in its user search feature. Added November 2009
| [http://jeffchannell.com/Joomla/fbb-1596-rc-multiple-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''Testimonial Ku 2.0 Admin Panel'''
| Summary: The Joomla component '''Testimonial Ku 2.0''' is vulnerable to persistent XSS in the administrator panel. A malicious user can submit a testimonial containing <script> tags with absolutely no quotes and inject that script into the administrator panel through any of the available inputs except "email". Added November 2009
| [http://jeffchannell.com/Joomla/testimonial-ku-20-admin-panel-persistent-xss.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''MS Comment 0.8.0b'''
| Summary '''MS Comment 0.8.0b for Joomla''', a commenting plugin, suffers from an multiple vulnerabilities. Added November 2009
| [http://jeffchannell.com/Joomla/ms-comment-080b-multiple-vulnerabilities.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:#cef2e0; color:black" | '''!JoomlaComment 4.0 beta1'''
| Summary: '''!JoomlaComment 4.0 beta1''', a commenting plugin, suffers from multiple XSS vulnerabilities. Added November 2009
| [http://jeffchannell.com/Joomla/joomlacomment-40-beta1-multiple-xss-vulnerabilities.html Alert]
| style="background:#cef2e0; color:white" | ''' [http://compojoom.com/blog/8-news/121-joomlacomment-40-rc1-released Developer Notice 4.0 rc1]''
|-
| style="background:red; color:white" | '''WebAmoeba Ticket System 3.0.0'''
| Summary: '''WebAmoeba Ticket System 3.0.0''', a Joomla help desk component. The vulnerability is with the BBCode library used to parse BBCode tags, as it does not strip javascript: urls from [url] tags. Added November 2009
| [http://jeffchannell.com/Joomla/webamoeba-ticket-system-300-bbcode-xss.html Alert]
| style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Kunena 1.5.x'''
|Summary: This is an important security release and users are urged to update immediately. Five security issues and an Internet Explorer 8 table bug have been resolved in this release. This release also contains many other important bug fixes. Added 18 November 2009
|[http://www.kunena.com/blog/19-developer-blog/51-kunena-157-security-release-now-available Advisory]
|style="background:#cef2e0; color:white" |[http://www.kunena.com/blog/19-developer-blog/52-kunena-158-service-release-now-available Latest 1.5.8 Version]
|-
| style="background:red; color:white" | '''com_siirler'''
| Summary: SQL injection vulnerability in the '''Q-Proje Siirler Bileseni (com_siirler)''' component 1.2 RC for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in an sdetay action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3972 | CVE-2009-3972]]
| style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''jTips (com_jtips)'''
|SUmmary:SQL injection vulnerability in the '''jTips (com_jtips)''' component 1.0.7 and 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the season parameter in a ladder action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3971 |CVE-2009-3971]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''NinjaMonials'''
| Summary: SQL injection vulnerability in the '''NinjaMonials (com_ninjacentral)''' component 1.1.0 for '''Joomla 1.0.x''' ! allows remote attackers to execute arbitrary SQL commands via the testimID parameter in a display action to index.php. Added 18 November 2009
| [[NIST:CVE-2009-3964 | CVE-2009-3964]]
|style="background:#cef2e0; color:white" |''' [http://ninjaforge.com/index.php?option=com_ninjacentral&page=show_package&id=14&Itemid=235 developer patch Ver 1.2]'''
|-
|style="background:#cef2e0; color:black" | '''webee 1.1.1 &1.2'''
|Summary: '''webee 1.1.1,''' a Joomla commenting plugin, suffers from multiple vulnerabilities. '''webee has been updated to 1.2''' as of 12 November 2009 and''' still suffers''' from SQL Injection. XSS was not tested in 1.2. Added 19 November 2009
| [http://jeffchannell.com/Joomla/webee-111-multiple-vulnerabilities.html jeffchannell.com]
|style="background:#cef2e0; color:white" | ''' [http://extensions.joomla.org/extensions/contacts-and-feedback/articles-comments/10155 developer update ver2.0]'''
|-
|style="background:#cef2e0; color:black" |'''iF Portfolio Nexus'''
|Summary: The '''iF Portfolio Nexus component for Joomla!''' is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements using the id parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. Nov 18, 2009
|[http://secunia.com/advisories/37408/ secunia.com 37408/]
|style="background:#cef2e0; color:white" |[http://www.inertialfate.za.net/help/forums/topic?id=10&p=3#p172 iF Portfolio Nexus v1.1.1 released]

|-
|style="background:red; color:white" | '''JoomClip'''
|Summary: The '''JoomClip component for Joomla!''' is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the index.php script using the cat parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. Nov 18, 2009
|[http://secunia.com/advisories/37400/ secunia.com 37400/]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Joomla XML'''
|Summary: Joomla! before 1.5.15 allows remote attackers to read an extension's XML file, and thereby obtain the extension's version number, via a direct request.
Published: 11/16/2009
|[[NIST:CVE-2009-3946 | CVE-2009-3946]]
|style="background:#cef2e0; color:white" |'''[http://developer.joomla.org/security/news/306-20091103-core-xml-file-read-issue.html Resolution]'''
|-
|style="background:red; color:white" | '''Mygallery Remote SQL Injection Vulnerability'''
|Summary: Joomla Component mygallery ( farbinform_krell) Remote SQL Injection Vulnerability Added 27 Nov 2009 {{JVer|1.5}} NB: This could be an error in our database as the only one we could find was for wordpress.If anyone know of one for joomla please let us know..(poss joomlicious.com CM)
|[http://www.exploit-db.com]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Extreme Google Calendar'''
|Summary: '''com_gcalendar 1.1.2''' (gcid) Remote SQL Injection Vulnerability
Remote SQL Injection were identified in Google Calendar Component [http://extensions.joomla.org/extensions/calendars-a-events/calendars/4188 Extension Link] Added 27 Nov 2009
|[http://www.exploit-db.com reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''LyftenBloggie'''
| Summary: [http://www.lyften.com/products/lyftenbloggie.html LyftenBloggie] Component "author" SQL Injection Vulnerability LyftenBloggie 1.x Added 27 Nov 2009
|[http://secunia.com/advisories/product/28005/ SA37499]
| [http://jeffchannell.com/Joomla/lyften-bloggie-sql-injection-fix.html Un official fix]. Developer fix not release at 30 Nov 09 ''' [http://www.lyften.com/products/lyftenbloggie/extensions/download/id-20.html 1.0.4a (last update on Dec 28, 2009)]'''
|-
|style="background:#cef2e0; color:black" |'''Sermon speaker'''
|Summary: [http://joomlacode.org/gf/project/sermon_speaker sermon speaker] sql vulnerability and password reset vulnerability version 3.2 and below
|
|style="background:#cef2e0; color:white" |[http://joomlacode.org/gf/project/sermon_speaker/forum/?action=ForumBrowse&forum_id=7897&_forum_action=ForumMessageBrowse&thread_id=15219 Developer fix] 30 Nov 2009
|-
|style="background:#cef2e0; color:white" | [http://joomlacode.org/gf/project/musicgallery/ MusicGallery]
|Summary: [http://joomlacode.org/gf/project/musicgallery/ Component MusicGallery] SQL Injection Vulnerability 30 November {{JVer|1.5}}
|[[NIST:CVE-2009-4217 | CVE-2009-4217]]
|style="background:#cef2e0; color:black" | [http://joomlacode.org/gf/project/musicgallery/ developer]
|}

----

== December 2009 Compiled Reports ==
{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''
|-
|style="background:red; color:white" | '''Omilen Photo Gallery'''
|Summary: Directory traversal vulnerability in the [http://extensions.joomla.org/extensions/photos-&-images/photo-flash-gallery/6373/details Omilen Photo Gallery] (com_omphotogallery) component Beta 0.5 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php.
Published: 12/04/2009
|[[NIST:CVE-2009-4202 | CVE-2009-4202]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Seminar'''
|Summary: SQL injection vulnerability in the [http://seminar.vollmar.ws/ Seminar] (com_seminar) component 1.28 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a View_seminar action to index.php.
Published: 12/04/2009
|[[NIST:CVE-2009-4200 | CVE-2009-4200]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Mambo Resident'''
|Summary: Multiple SQL injection vulnerabilities in the Mambo Resident (aka Mos Res or com_mosres) component 1.0f for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) property_uid parameter in a viewproperty action to index.php and the (2) regID parameter in a showregion action to index.php. Mambo Resident component for v4.5.2 '''may only be for 1.0.xx versions of J!'''
Published: 12/04/2009
|[[NIST:CVE-2009-4199 | CVE-2009-4199]]
|style="background:#cef2e0; color:white" |[http://www.jomres.net/ Replacement Extension 08 dec 09]
|-
|style="background:red; color:white" | '''ProofReader'''
|Summary: Multiple cross-site scripting (XSS) vulnerabilities in index.php in the ProofReader (com_proofreader) component 1.0 RC9 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in (1) 404 or (2) error pages. Published: 12/02/2009 CVSS Severity: 4.3 (MEDIUM)
| [[NIST:CVE-2009-4157 | CVE-2009-4157]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Laoneo Google Calendar GCalendar'''
|Summary: SQL injection vulnerability in the [http://g4j.laoneo.net/content/extensions/download/cat_view/20-joomla-15x/21-gcalendar.html Google Calendar GCalendar] (com_gcalendar) component 1.1.2, 2.1.4, and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the gcid parameter. NOTE: some of these details are obtained from third party information. Published: 11/29/2009 CVSS Severity: 7.5 (HIGH) Note: There is already a listing for GCalendar 1.1.2
|[[NIST:CVE-2009-4099 | CVE-2009-4099]]
|style="background:#cef2e0; color:white" | [http://g4j.laoneo.net/content/extensions/download/doc_details/28-gcalendar-suite-215.html Latest version GCalendar Suite 2.1.5]
|-
|style="background:red; color:white" | '''D4J eZine'''
|Summary: PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS mosConfig_absolute_path parameter. Published: 11/29/2009 CVSS Severity: 7.5 (HIGH)
|[[NIST:CVE-2009-4094 | CVE-2009-4094]]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''Quick News'''
| Summary: The Joomla [http://joomlacode.org/gf/project/quicknews/ Quick News component] suffers from a remote SQL injection vulnerability. added 1st Dec 09
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Joaktree component'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/genealogy/9842 Joaktree] Vulnerability : SQL injection/ added 1st Dec 09
|[http://securityreason.com/exploitalert/7508 7508]
|style="background:#cef2e0; color:white" | ''' [http://naastniels.nl/index.php/en/joaktree/downloads version 1.1 update]'''
|-
|style="background:red; color:white" | '''mojoblog'''
|Summary [http://www.joomlify.com/files/mojoblog/ MojoBlog] Multiple Remote File Include Vulnerability added 1st Dec 09 {{JVer|1.5}}
|[http://securityreason.com/exploitalert/7509 7509]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''YJ Whois'''
|Summary: [http://extensions.joomla.org/extensions/external-contents/domain-search/5774 YJ Whois] '''Low security risk''',and fixesMalicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. Files affected is , modules/mod_yj_whois.php added 3 December 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" |[http://www.youjoomla.com/xss-security-patch-for-yj-whois.html Developer Notice and fix 03 dec 09]
|-
|style="background:#cef2e0; color:black" | '''yt_color YOOOtheme'''
|Summary: [http://www.yootheme.com/ YT_color yootheme] Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. added 5 dec 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.yootheme.com/member-area/downloads/item/templates-15/xss-and-php-53-patches All members without an active membership can download the template patches here].'''
|-
|style="background:red; color:white" | '''TP Whois'''
|summary: [http://www.templateplazza.com/view-details/tpwhois/183-component-tp-whois-for-joomla-1.5.x.html TP Whois ] Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account. Added 3 december {{JVer|1.5}}
|[http://www.exploit-db.com Refrence]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_job'''
|Summary: Component com_job ( showMoreUse) SQL injection vulnerability Added 9th Dec
|[http://xforce.iss.net/xforce/xfdb/54626 Reference]
| style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''JQuarks'''
|Summary: [http://extensions.joomla.org/extensions/contacts-and-feedback/quiz-a-surveys/10590 JQuarks] SQL injection vulnerability {{JVer|1.5}} added 8th dec 09
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | [http://www.iptechinside.com/labs/projects/list_files/jquarks Developer Update ]
|-
|style="background:red; color:white" | '''Mamboleto Component 2.0 RC3'''
|Summary: [http://www.fernandosoares.com.br/index.php?option=com_docman&task=cat_view&gid=28&Itemid=28 Mamboleto Component 2.0 RC3]SQL injection vulnerability {{JVer|1.5}} added 12 December
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:#cef2e0; color:black" | ''' JS JOBS'''
|Summary [http://www.joomshark.com/index.php?option=com_content&view=article&id=4&Itemid=8 JS JOBS] Joomla Component com_jsjobs 1.0.5.6 SQL Injection Vulnerabilities {{JVer|1.5}} added 12 December
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.joomsky.com/index.php?option=com_rokdownloads&view=folder&Itemid=3&id=2:components Developer update 1.0.5.7]'''
|-
|style="background:#cef2e0; color:black" | '''corePHP JPhoto'''
|Summary: [http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10365 'corePHP' JPhoto]SQL injection vulnerability {{JVer|1.5}} added 12 December
|[http://secunia.com/advisories/37676/ Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.corephp.com/blog/uber-fast-jphoto-security-release/ Developer Upgrade]'''
|-
|style="background:#cef2e0; color:black" | '''com_virtuemart'''
|Summary: "com_virtuemart" http://virtuemart.net/ '''Version : 1.0''' Vulnerability : SQL injection added Date : 07- dec -09 {{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" |[http://virtuemart.net/ latest version]
|-
|style="background:red; color:white" | ''' Kide Shoutbox'''

|Summary: The Kide Shoutbox (com_kide) component 0.4.6 for Joomla! does not properly perform authentication, which allows remote attackers to post messages with an arbitrary account name via an insertar action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Added: December 08
|[[NIST:CVE-2009-4232 | CVE-2009-4232]]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | ''' JoomPortfolio Component'''
|Summary: [http://www.joomplace.com/joomportfolio/joomportfolio.html JoomPortfolio] Input passed via the "secid" parameter to index.php (when "option" is set to "com_joomportfolio" and "task" is set to "showcat") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.The vulnerability is reported in version 1.0.0. Other versions may also be affected. Added: December 18 {{JVer|1.5}}
|[http://secunia.com/advisories/37838/ Reporting Site]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''City Portal (templates?)'''
|Summary: City Portal Blind SQL Injection Vulnerability added: 2009-12-18
|[http://www.exploit-db.com Reference] Possibly this [http://www.youjoomla.com/jclick-city-portal-joomla-template.html tempate]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Event Manager'''
|Summary: [http://www.jforjoomla.com/Joomla-Components/event-manager-15-component.html Event Manager] Blind SQL Injection Vulnerability EDB-ID: 10549
added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | com_zcalendar
|Summary: com_zcalendar Blind SQL-injection Vulnerability
EDB-ID: 10548 added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_acmisc'''
|Summary: com_acmisc SQL injection added: 2009-12-18
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''com_digistore'''
|Summary: com_digistore SQL injection EDB-ID: 10546 added: 2009-12-18 {{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.ijoomla.com/ijoomla-digistore/ijoomla-digistore/ijoomla-digistore-change-log/ Update change log] '''
|-
|style="background:red; color:white" | '''com_jbook'''
|Summary: com_jbook Blind SQL-injection EDB-ID: 10545 added: 2009-12-18 {{JVer|1.0}}
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_personel'''
|Summary: com_personel component for Joomla! is vulnerable to SQL injection.
|[http://xforce.iss.net/xforce/xfdb/54903 iss.net reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''JEEMA Article Collection'''
|Summary: [http://www.forum.jeema.net/component/content/article/4-jeema-article-collection-component/13-about-jeema-article-collection.html JEEMA Article Collection] Input passed via the "catid" parameter to index.php (when "option" is set to "com_jeemaarticlecollection" and "view" is set to "longlook") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. version 1.0.0.1 {{JVer|1.5}} added 22 dec 09
| [http://secunia.com/advisories/37865/ secunia]
|style="background:#cef2e0; color:white" | [http://www.jeema.net/downloads/free-joomla-extensions/joomla-components/12-jeema-joomla-article-collection.htm fixed the same in the version v102.]
|-
|style="background:red; color:white" | '''HotBrackets Tournament Brackets '''
|Summary: The [http://extensions.joomla.org/extensions/sports-a-games/sports/10746 HotBrackets Tournament Brackets] component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. {{JVer|1.5}} added 22 dec
|[http://www.securityfocus.com/bid/37439/ Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Car Manager'''
|Summary: http://webformatique.com/ com_carman Cross Site Scripting Vulnerability added 24 december 09{{JVer|1.5}}
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" |'''Schools component'''
|Summary: The 'com_schools' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|[http://www.securityfocus.com/bid/37469 Reference] added 24 dec 09
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''webcamxp'''
|[http://extensions.joomla.org/extensions/communication/video-conference/4490 com_webcamxp] Cross Site Scripting Vulnerabilities Last version 2008 {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''beeheard'''
|[http://extensions.joomla.org/extensions/contacts-and-feedback/testimonials-a-suggestions/10283 beeheard] Blind SQL injection Vulnerability {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://beeheard.cmstactics.com/change-log Version 1.4.2] 04 Jan'''
|-
|style="background:red; color:white" | '''jm-recommend'''
|jm-recommendCross Site Scripting Vulnerabilities. unable to locate on jed. {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | facileforms
| com_facileforms Cross Site Scripting Vulnerabilities. unable to locate on jed. Product considered retired. {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''adagency'''
| [http://www.ijoomla.com/ijoomla-ad-agency/ijoomla-ad-agency/index/ adagency ]Vulnerabilities {{JVer|1.5}} Dec 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''com_intuit'''
|[http://www.san-diego-web-designer.com/new-file-download/item/root/aboutimage-igateway-for-joomla.html com_intuit]Local File Inclusion Vulnerability {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.securityfocus.com/bid/37494/discuss Retired]'''
|-
|style="background:red; color:white" | '''MemoryBook'''
|[http://extensions.joomla.org/extensions/calendars-a-events/birthdays-a-historic-events/10868 MemoryBook 1.2] Multiple Vulnerabilities. requires: magic quotes OFF, user account {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''qpersonel'''
|[http://extensions.joomla.org/extensions/directory-a-documentation/thematic-directory/7049 qpersonel ] Cross Site Scripting Vulnerabilities {{JVer|1.0}}[[Image:http://extensions.joomla.org/images/jed/compat_15_legacy.png]] Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''opryknings point'''
|com_oprykningspoint_mc Cross Site Scripting Vulnerabilities {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''trabalhe conosco'''
|com_trabalhe_conosco Cross Site Scripting Vulnerabilities {{JVer|1.5}} Dec. 27
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''DhForum'''
|com_dhforum SQL Injection Vulnerability. considered retired/EOL Dec. 27 {{JVer|1.0}}1.5 legacy
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''com_morfeoshow'''
|[http://extensions.joomla.org/extensions/photos-a-images/photo-gallery-add-ons/9810 morfeoshow] this was a false report
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:black" | ''' false report'''
|-
|style="background:#cef2e0; color:black" |'''Run Digital Download rd-download'''
|[http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7838 RD Download] Local File Disclosure Vulnerability {{JVer|1.5}} Dec. 30 Version affected not disclosed.
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7838 Version 0.9 relased]
|-
|
|
|
|
|}

----

== January 2010 Reported Vulnerable Extensions ==

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic or the [http://forum.joomla.org/viewforum.php?f=470 extensions] topic clearly marked with the first word in the title being ''Vulnerable'' where the security moderators or JSST team will respond.
''This list is change protected, for updates or editing requests [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
''

[http://docs.joomla.org/Vulnerable_Extensions_List Back To Top]

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Reference Link'''
! '''Extension Update Link'''

|-
|style="background:#cef2e0; color:black" |JvideoDirect
|Summary: [http://extensions.joomla.org/extensions/multimedia/video-players-a-gallery/9501 Jvideodirect] SQLi Jan 29
|
|http://www.jvideodirect.com/ Update version 2.5
|style="background:red; color:white" | ''' '''
|-
|style="background:#cef2e0; color:black" |'''JEvent search plugin'''
|Summary: JEvent search plugin for [http://extensions.joomla.org/extensions/calendars-a-events/events/95 JEvent] SQLi reported Jan 29
|
|style="background:#cef2e0; color:white" | ''' [http://www.jevents.net/forum/viewtopic.php?f=17&t=3910#p15526 upgrade to 1.5.3b]'''
|
|-
|style="background:#cef2e0; color:black" |'''Kunena'''
|Summary: [http://extensions.joomla.org/extensions/communication/forum/7256/details kunena] re reported suffering SQLi in version 1.5.9 Jan 29 Confirmation Required '''Now found to be malicious'''
|
|style="background:#cef2e0; color:black" | ''' [http://www.kunena.com/blog/19-developer-blog/51-kunena-157-security-release-now-available Versions 1.5.5 and below only]'''
|
|-
|style="background:red; color:white" |'''JE Quiz'''
|Summary : http://extensions.joomla.org/extensions/contacts-and-feedback/quiz-a-surveys/11212 JeQuiz SQLi reported 29 Jan
|
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black"" |'''idoblog'''
|summary: exploitable due to open file permissions. 28 Jan
|Private Notification
|style="background:#cef2e0; color:black" | ''' [http://idojoomla.com/news.html build 35 released] '''
|-
|style="background:#cef2e0; color:black" |'''ccnewsletter'''
|Summary [http://extensions.joomla.org/extensions/5112/details ccnewsletter Directory Traversal Vulnerability] Jan 28
|Private Notification
|style="background:#cef2e0; color:white" | ''' [http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html version 1.0.6 released 29 Jan]'''
|-
|style="background:#cef2e0; color:white" |'''Virtuemart 1.1.4'''
|Summary: [http://extensions.joomla.org/extensions/e-commerce/shopping-cart/129 virtuemart] Input var order_status_id is vulnerable to SQLi NB Requires Higher Level access before exploiting. Jan 27
|
|style="background:#cef2e0; color:black" | ''' [http://forum.joomla.org/viewtopic.php?p=2027005#p2027005 developer patches]'''
|-
|style="background:#cef2e0; color:black" |'''JBDiary'''
|Summary: [http://extensions.joomla.org/extensions/calendars-a-events/events/11009 JBDiary] BLIND SQL Injection Vulnerabilities Jan 24 [http://www.jb-soft.nl/ http://www.jb-soft.nl/]
|
|style="background:#cef2e0; color:white" | ''' [http://www.jb-soft.nl/index.php?option=com_content&view=article&id=64 Developer Update 27 Jan]'''
|-
|style="background:#cef2e0; color:black" |'''JbPublishDownFp'''
|Sumary: [http://extensions.joomla.org/extensions/news-production/timed-content/6496 JbPublishDownFp] SQL Injection Vulnerability Jan 24 [http://www.jb-soft.nl http://www.jb-soft.nl]
|
|style="background:#cef2e0; color:white" |''' [http://www.jb-soft.nl/index.php?option=com_content&view=article&id=64 Developer Update Jan 27]'''
|-
|style="background:red; color:white" |'''com_casino'''
|Summary: [http://extensions.joomla.org/extensions/sports-a-games/tips-a-betts com_casino]
SQL Injection Vulnerabilities Jan24
|
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |'''Mochigames'''
|Summary: [http://extensions.joomla.org/extensions/search/mochigames com_Mochigames]
SQL Injection Vulnerabilities Jan24
|
|style="background:#cef2e0; color:white" | ''' [http://www.yoflash.com/download.html mochigames_alpha052 Released]'''
|-
|style="background:red; color:white" |'''ContentBlogList'''
|Summary: [http://extensions.joomla.org/extensions/news-production/blog/10989 com_ContentBlogList] SQL Injection Vulnerability Jan 23
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |MailChimp for Joomla 1.5
|Summary: [http://extensions.joomla.org/extensions/bridges/mailing-a-newsletter-bridges/7836 MailChimp for Joomla 1.5] jan 17
|Developer Statement
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''JoomlaXML'''
|Summary: [http://extensions.joomla.org/extensions/tools/design-tools/5020 JoomlaXML] malicious code insertion
|
|style="background:red; color:white" | ''' Not Known'''
|-
| style="background:red; color:white" | '''JVClouds3D SWF module'''
|[http://joomlapro.ru/3djvclouds JVClouds3D SWF module] Cross Site Scripting . jan 14
|[http://xforce.iss.net/xforce/xfdb/55535 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''JVClouds3D'''
|[http://joomlapro.ru/3djvclouds JVClouds3D module] Cross Site Scripting . jan 14
|[http://xforce.iss.net/xforce/xfdb/55534 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''JA Showcase'''
|[http://www.joomlart.com/addons/components_and_modules/ja_showcase.html JA Showcase component] Directory Traversal jan 14
|[http://xforce.iss.net/xforce/xfdb/55512 xforce]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''jprojects'''
|Summary: Unknown Author com_j-projects Blind SQL Injection Vulnerability. Jan 10 detail update
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''jEmbed-Embed Anything'''
|[http://www.joshprakash.com/index.php?option=com_docman&task=doc_details&gid=70 jEmbed-Embed Anything] A vulnerability has been discovered in the jEmbed-Embed Anything component for Joomla, which can be exploited by malicious people to conduct SQL injection attacks. Jan 10
|[http://secunia.com/advisories/38112 Secunia Advisory: SA38112]
|style="background:red; color:white" | [http://extensions.joomla.org/extensions/3699/details Product considered retired]
|-
|style="background:#cef2e0; color:black" |'''perchagallery '''
|Summary: perchagallery [http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10350 com_perchagallery] SQL Injection Vulnerability Jan 7
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.percha.com/index.php?option=com_phocadownload&view=file&id=22:1.5&Itemid=20 Developer Update 1.5b]'''
|-
|style="background:#cef2e0; color:black" | '''CARTwebERP'''
|Summary: [http://extensions.joomla.org/extensions/bridges/e-commerce-bridges/8753 CARTwebERP] Local File Inclusion Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://extensions.joomla.org/extensions/bridges/e-commerce-bridges/8753 1.56.76 (last update on Jan 11, 2010)]'''
|-
|style="background:#cef2e0; color:black" | '''JoomlaBibleStudy'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/religion/3461 JoomlaBibleStudy] LFI Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | '''[http://joomlabiblestudy.org/invisible-downloads/category/3-component.html Developer reported update]'''
|-
|style="background:#cef2e0; color:black" | '''com_bfsurvey_basic and pro'''
|Summary: [http://www.tamlyncreative.com.au/software/ BFsurvey] SQL Injection Vulnerability ,LFI Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.tamlyncreative.com.au/software/forum/index.php?topic=641.0 Developer Update announcement]'''
|-
|style="background:red; color:white" | '''Alfresco'''
|Summary: SQL Injection Vulnerability. Not believed to be Joomlatools extension Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''abbrev'''
|Summary: [http://extensions.joomla.org/extensions/directory-a-documentation/glossary-a-dictionary/4965 abbrev] Local File Inclusion Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''countries'''
|Summary: [http://extensions.joomla.org/extensions/miscellaneous/development/6553 countries] SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Dedicated Component com_tpjobs'''
|Summary: [http://www.templateplazza.com/ tpjobs] SQL Injection Vulnerability unable to locate files probably template plaza Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:#cef2e0; color:white" | ''' [http://www.templateplazza.com/extensions-updates/tpjobs-component-update-v-1.1.html Developer Update] '''
|-
|style="background:red; color:white" | '''Component com_doqment'''
|SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''Component com_otzivi'''
|Blind SQL Injection Vulnerability Jan. 3
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" | '''aprice'''
|Summary: [http://adeptweb.info/component/option,com_aprice/Itemid,109/ com_aprice] Component 'analog' Parameter SQL Injection Vulnerability
|[http://www.securityfocus.com/bid/37575 Report]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:red; color:white" |'''cartikads'''
|Summary: [http://www.cartikahosting.com com_cartikads] Remote File Upload Vulnerability
'''Mambo''' Open Source ads management component
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''Docman seller'''
|Summary: [http://extensions.joomla.org/extensions/e-commerce/subscriptions/5000 Document seller] Input passed via the "id" parameter to index.php (when "option" is set to "com_dm_orders", "task" is set to "order_form", and "payment_method" is set to "Paypal") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
|[http://secunia.com/advisories/38024/ secunia]
|style="background:#cef2e0; color:white" | [http://extensions.joomla.org/extensions/e-commerce/subscriptions/5000 Updated 10th Jan]
|-
|style="background:#cef2e0; color:black" | '''ozio gallery'''
|summary: [http://extensions.joomla.org/extensions/photos-a-images/photo-flash-gallery/4883 Ozio Gallery2] SQLi eploit
|[http://www.viruslist.com/en/advisories/37974 Reference]
|style="background:#cef2e0; color:white" |[http://oziogallery.joomla.it/index.php?option=com_content&view=article&id=62%3Anuova-ozio-gallery-23-aggiornamento-di-sicurezza&catid=2%3Anotizie&Itemid=13&lang=en developer update Jan 11]
|-
|style="background:#cef2e0; color:black" | '''RD-Autos Free'''
|[http://extensions.joomla.org/extensions/vertical-markets/vehicles/5458 RD-Autos Free ] This version is now commercial not free
|Private advisory to JED Jan 11
|style="background:red; color:white" | ''' Product Retired and replaced'''
|-
|style="background:red; color:white" | '''DailyMeals'''
|Summary: [http://extensions.joomla.org/extensions/vertical-markets/food-a-beverage/4764 dailymeals] Local File Inclusion Vulnerability Jan 02
|[http://www.exploit-db.com Reference]
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" | '''RD-Autos Pro'''
|[http://extensions.joomla.org/extensions/vertical-markets/vehicles/6357 RD Autos Pro]
|Private advisory to JED Jan 11
|style="background:#cef2e0; color:black" | ''' Upgrade to Latest version be 2.0.2'''
|-
|
|
|
|
|}

== New format Feed Starts Here ==
Please do not change your [http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions feed url], only the feed format has changed.

== February, March, April, May 2010 Reported Vulnerable Extensions ==
<startFeed />

'''Please check with the extension publisher in case of any questions over the security of their product.'''
Report Vulnerable extensions either in the [[jforum:432]] security topic clearly marked with the first word in the title being ''Vulnerable Report'' where the security moderators or JSST team will respond. For a guide to the [http://docs.joomla.org/Vulnerable_Extensions_List_0210#Codes_used codes]

[http://docs.joomla.org/Vulnerable_Extensions_List Previous Reports]

{| class="wikitable sortable" border="1"
|-
! '''Extension'''
! class="unsortable"| '''Details'''
! '''Date Added'''
! class="unsortable" |'''Extension Update Link & Date'''
|-
|style="background:red; color:white" |

== JE Poll ==
|http://slideshow.joomlaextensions.co.in/ SQL Injection Vulnerability
|
|
|-
|style="background:red; color:white" |

== MyCar ==
|http://www.unisoft.me/extensions/ sqli ID
|
|
|-
|style="background:red; color:white" |

== MediQnA ==
|MediQnA LFI vulnerability version : v1.1
|
|
|-
|style="background:red; color:white" |

== JE Job ==
|http://joomlaextensions.co.in/ LFI SQLi
|
|
|-
|style="background:#cef2e0; color:black"|

== BF Quiz ==
|SQL Injection Exploit Version(s) = 1.3.0
|
|[http://www.tamlyncreative.com.au/software/forum/index.php?topic=729.0 Developer update to BF Quiz v1.3.1]
|-
|

== ==
|
|
|
|-
|style="background:#cef2e0; color:black"|

== Ozio Gallery 2 ==
|DT and open email relay
|280510
|[http://oziogallery.joomla.it/index.php?option=com_content&view=article&id=65:rilasciata-la-versione-ozio-gallery-25&catid=2:notizie&Itemid=13&lang=en Developer update and security release] 010610
|-
|style="background:red; color:white" |

== SectionEx ==
|Stack Ideas section Ex LFI
|
|
|-
|style="background:red; color:white" |

== ActiveHelper LiveHelp ==
|XSS in [http://extensions.joomla.org/extensions/communication/chat/12492 LiveHelp]
|200510
|
|-
|style="background:#cef2e0; color:black"|
== RS Comments ==
|XSS Vulnerability
|
|http://www.rsjoomla.com/customer-support/documentations/96--general-overview-of-the-component/393-changelog.html - fix posted 210510
|-
|style="background:red; color:white" |

== BCA RSS Feed ==
|LFI and other vulnerabilities
|
|Since changed its name to NinjaRss
|-
|

== SimpleDownload ==
|http://extensions.joomla.org/extensions/directory-a-documentation/downloads/10717 various exploits
|160510
|updated version (version 0.9.6)
|-
|style="background:red; color:white" |
== JE Quotation Form ==
|http://joomlaextensions.co.in/free-download/doc_download/11-je-quotation-form.html LFI
|
|
|-
|style="background:red; color:white" |

== konsultasi ==
|SQL Injection Vulnerability
|
|
|-
|style="background:red; color:white" |

== Aardvertiser ==
|Local File Inclusion Vulnerability
http://extensions.joomla.org/extensions/ads-a-affiliates/classified-ads/9454
|
|
|-
|style="background:red; color:white" |

== Seber Cart ==
|Local File Disclosure Vulnerability
|
|[http://www.sebercart.com/index.php?option=com_content&view=article&id=158 Developer Update 140510]
|-
| style="background:#cef2e0; color:black"|

== FDione Form Wizard ==
|lfi vulnerability
|140510 200510
|[dionesoft.com Update to Dione Form Wizard (v. 1.0.4)].
|-
| style="background:#cef2e0; color:black"|

== Custom PHP Pages ==
|http://extensions.joomla.org/extensions/edition/custom-code-in-content/5057 LFI Vulnerability
|
|[fijiwebdesign.com Developer declares not vulnerable 140510]
|-
|style="background:red; color:white" |

== Camp26 Visitor ==
|RFI www.camp26.biz
|
|
|-
|style="background:#cef2e0; color:black"|

== iJoomla News Portal ==
|RFI SID
|
|[http://www.ijoomla.com/forum/index.php/topic,4480.0.html Update to 1.5.10]
|-
| |

== article Factory Manager ==
|RFI & Input Validation Error http://www.thefactory.ro/shop/joomla-components/article-manager.html
|may 2010
|can not reproduce and unproven, http://www.thefactory.ro
|-
|style="background:red; color:white" |

== Table JX Component ==
|http://www.toolsjx.com/ Table JX Component XSS
|060510 - update 130510
|Version: 1.5.5 considered unsafe
|-
|style="background:red; color:white" |

== JE Property ==
|JE Property Finder Upload Vulnerability
|
|
|-
|style="background:red; color:white" |

== Noticeboard ==
|Noticeboard for Joomla "controller" Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

==SmartSite ==
|SmartSite com_smartsite Local File Inclusion Vulnerability
|
|
|-
|style="background:#cef2e0; color:black" |

== ABC ==
|ABC SQL Injection Vulnerability
|
|reported as updated to JED 290410
|-
|style="background:red; color:white" |

== htmlcoderhelper graphics ==
|htmlcoderhelper graphics v1.0.6 LFI Vulnerability
|
|
|-
|style="background:red; color:white" |

== Ultimate Portfolio ==
|Ultimate Portfolio Local File Inclusion Vulnerability
|
|
|-
|style="background:#cef2e0; color:black" |

== huruhelpdesk ==
|http://www.huruhelpdesk.net sqli injection
|
|[http://www.huruhelpdesk.net/forums/8-announcements/392--sql-injection-reveals-user-md5-password-hash Reported fix]
|-
|style="background:red; color:white" |

== Archery Scores ==
| [http://lispeltuut.org/ Archery Scores (com_archeryscores) v1.0.6 LFI Vulnerability]

|210410
|
|-
|style="background:red; color:white" |

== ZiMB Manager ==
|Joomla Component ZiMB Manager Local File Inclusion Vulnerability
|210410
|
|-
|style="background:red; color:white" |

== Matamko ==
|Matamko Local File Inclusion Vulnerability
|210410
|
|-
|style="background:red; color:white" |

== Multiple Root ==
|Multiple Root Local File Inclusion Vulnerability http://joomlacomponent.inetlanka.com/
|
|
|-
|style="background:red; color:white" |

== Multiple Map ==
|Multiple Map Local File Inclusion Vulnerability joomlacomponent.inetlanka.com
|
|
|-
|style="background:red; color:white" |

== Contact Us Draw Root Map ==
|Draw Root Map Local File Inclusion Vulnerability joomlacomponent.inetlanka.com
|
|
|-
|style="background:red; color:white" |

== iF surfALERT ==
|[http://www.inertialfate.za.net/ iF surfALERT] Local File Inclusion Vulnerability
|
|
|-
|style="background:red; color:white" |

== GBU FACEBOOK ==
|GBU FACEBOOK SQL injection vulnerability http://www.gbugrafici.nl/gbufacebook/
|
|
|-
|style="background:red; color:white" |

== jnewspaper ==
|jnewspaper (cid) SQL Injection Vulnerability
|
|
|-
|style="background:#cef2e0; color:black"|

== JTM Reseller ==
|TM Reseller SQL injection vulnerability
|
|[http://jtmreseller.com/ Developer Update]
|-
|style="background:#cef2e0; color:black" |

== media Mall Factory ==
|SQLi
|200410
| [http://www.thefactory.ro/contact-us/product-update-request.html Solution: update to 1.0.5]

|-
|style="background:#cef2e0; color:black"|

== Gadget Factory ==
|LFi
|200410
|[http://www.thefactory.ro/contact-us/product-update-request.html Solution: update to 1.5.1]
|-
|style="background:#cef2e0; color:black"|

== Deluxe Blog Factory ==
|SQLi
|200410
|[http://www.thefactory.ro/contact-us/product-update-request.html update to 1.1.2]
|-
|

== ==
|
|
|-
|style="background:red; color:white" |
== MT Fire Eagle ==

|LFI http://joomlacode.org/gf/project/jfireeagle/frs/ http://www.moto-treks.com
| 190410
| product considered retired and to be replaced by dev
|-

|

== com properties ==
| http://com-property.com/ SQL I
|
|[http://www.com-property.com/images/fbfiles/files/properties-20100413.txt developer announced fix]
|-
|style="background:red; color:white"|

== Sweetykeeper ==
|Sweetykeeper Local File Inclusion Vulnerability http://www.joomlacorner.com/
|120410
|
|-
|style="background:red; color:white"|

== jvehicles ==
|SQL Injection http://jvehicles.com
|120410
|
|-
|style="background:red; color:white"|

== worldrates ==
|http://dev.pucit.edu.pk/
|120410
|
|-
|style="background:red; color:white"|

== cvmaker ==
|http://dev.pucit.edu.pk/
|
|
|-
|style="background:red; color:white"|

== advertising ==
|http://dev.pucit.edu.pk/
|
|
|-
|style="background:red; color:white"|

== horoscope ==
|http://dev.pucit.edu.pk/
|120410
|
|-
|style="background:red; color:white"|

== webtv ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:red; color:white"|

== diary ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:#cef2e0; color:black"|

== Multi-Venue Restaurant Menu Manager (MVRMM) ==
|http://www.focusdev.co.uk/
|120410
||[http://extensions.joomla.org/extensions/vertical-markets/food-a-beverage/10015 Version 1.5.2 Stable Update 4]
|-
|style="background:red; color:white"|

== Memory Book ==
|http://dev.pucit.edu.pk/
|120410
|-
|style="background:red; color:white"|

== TRAVELbook ==
| http://www.demo-page.de/
|120410
|-
|style="background:#cef2e0; color:black"|

== AlphaUserPoints ==
|
|[http://www.alphaplug.com/index.php/downloads.html?func=fileinfo&id=31 developer upgrade]

|-
|style="background:red; color:white"|

== JprojectMan ==
|LFI http://extensions.joomla.org/extensions/communities-a-groupware/project-a-task-management/5676
|110410
|-
|style="background:#cef2e0; color:black"|

== CKForms ==
|1.3.4 release - Important LFI security fix [http://joomlacode.org/gf/project/ckforms/news/?action=NewsThreadView&id=2814 ]
|07-04-10
|[http://ckforms.cookex.eu/download/download.php upgrade]
|-
|style="background:red; color:white"|

== econtentsite ==
|LFI
|040410
|-
|style="background:red; color:white"|

== Jvehicles ==
|ID
|040410
|-
|

== ==
|
|
|-
|style="background:#cef2e0; color:black"|

== smestorage ==
|[http://www.smestorage.com SMEStorage] LFI

|Updated 29 March 10
|[http://gelembjuk.com/index.php?option=com_content&view=section&layout=blog&id=1&Itemid=55 developer fix] to 1.1
|-
|style="background:#cef2e0; color:black"|

== JE Tooltip ==
|[http://joomlaextensions.co.in/formcreator/ JE Tooltip] LFI
|Updated 23 March
|-
|style="background:#cef2e0; color:black"|

== Gift Exchange Beta ==
|[http://extensions.joomla.org/extensions/communities-a-groupware/membership/11680 Gift exchange] SQLi
|Updated 23 March
|[http://socialables.com/28-Jomsocial/Gift-Exchange/flypage.tpl.html upgrade beta 1.0.1]

|-
|style="background:#cef2e0; color:black"|

== RokDownloads ==
|[[http://extensions.joomla.org/extensions/directory-a-documentation/downloads/7967 LFI]]
|15 march 2010
||upgrade to [http://www.rockettheme.com/extensions-updates/638-rokdownloads-10-released version 1.0]
|-
|style="background:red; color:white"|

== gigcalender ==

|SQLi [http://extensions.joomla.org/extensions/calendars-a-events/events/97)http://extensions.joomla.org/extensions/calendars-a-events/events/97 gigcalender]
|13 march 2010
|
|-
|style="background:red; color:white"|

== heza content ==
|SQLi [http://extensions.joomla.org/extensions/structure-a-navigation/sections-a-categories/10427)http://extensions.joomla.org/extensions/structure-a-navigation/sections-a-categories/10427 heza content]
|13 march 2010
|
|-
|style="background:red; color:white"|

== juliaportfolio ==
|LFI [http://extensions.joomla.org/extensions/directory-&-documentation/portfolio/8519/details juliaportfolio]
|13 march 2010
|
|-

|style="background:#cef2e0; color:black" |

== Flash Magazine Deluxe ==
|SQL Injection Vulnerability.
|Feb 25
|'''[http://www.joomplace.com/flash-magazine-deluxe/flash-magazine-deluxe-description.html Developer Update Version 2.0.11 09/03/10]'''
|-
|style="background:red; color:white" |

== SqlReport ==
|Sqlreport has a sql/RFI exploit. awaiting confirmation on exact developer.
|Feb 20
|'''Not Known'''
|-
|style="background:#cef2e0; color:black" |

== Scriptegrator ==
|Core Design [http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html Scriptegrator] RFI exploit
|Feb 20
|[http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html Dev Upgrade announcement]
|-
|style="background:#cef2e0; color:black" |

== AllVideos 3.1 ==
|
A vulnerability discovered in versions 3.0. and 3.1 of the plugin can be exploited by malicious people to disclose potentially sensitive information. For security reasons we will not be providing further details to safeguard users of affected versions. http://www.joomlaworks.gr/content/view/77/34/]|
|17 Feb
| [http://joomlaworks.googlecode.com/files/plg_jw_allvideos-v3.3_j1.5.zip Version 3.3 release 18th]
|-
|style="background:#cef2e0; color:black" |

== RW Cards ==
| [http://extensions.joomla.org/extensions/3430/details RW Card] LFI and ID exploit [http://www.weberr.de/ Dev Site]
|180210
|style="background:#cef2e0; color:black" |''' [http://www.weberr.de/index.php/forum.html?func=view&catid=5&id=1939&limit=6 developer update]'''
|-
|style="background:red; color:white" |

== Yelp ==
| SQLi - Unable to locate developer. Possibly a custom extension.
|Feb 01
|style="background:red; color:white" | ''' Not Known'''
|-
|style="background:#cef2e0; color:black" |

== '''Autartitarot''' ==
|Directory Traversal. Back end access required
| Feb 05
|style="background:#cef2e0; color:black" | ''' Please upgrade to [http://www.autartica.be/en/autartitarot version 1.0.4]'''
|-
|style="background:#cef2e0; color:black" |

== communitypolls ==
|LFI - [http://www.corejoomla.com/ community polls]
|Feb 17
||upgrade to [http://www.corejoomla.com/ version 1.5.3]
|-
|

== ==
|
|
|
|}
<endFeed />

''This list is change protected, for updates or additions [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville] or [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=87230 lafrance]
''

== Codes used ==
SQLi - SQL injection [http://en.wikipedia.org/wiki/Code_injection#SQL_injection wikipedia]

LFI - Local File Inclusion [http://www.scribd.com/doc/6498408/Remote-and-Local-File-Inclusion-Explained scribd]

RFI - Remote file inclusion [http://en.wikipedia.org/wiki/Remote_File_Inclusion wikipedia]

DT - Directory Traversal [http://en.wikipedia.org/wiki/Directory_traversal wikipedia]

ID = Information Disclosure: account information or sensitive information publicly viewable

== Developers - How to get yourself removed from the VEL ==

Resolved items will be removed after a suitable period and not on resolution

Please solve the issues and:

* If JED listed
Attach the new zip file at your actual JED listing.

Change the extension version at JED listing.

Contact the JED by mail back with a notice and ask them republish your listing.

* If not JED listed.
Inform us by PM of the link to your resolution notice on your website.

== Future Actions & WIP ==

[http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions RSS feed] completed

to feed VEL direct to twitter

== Notes ==
The RSS feed is currently fed by item entry order and not by date fixed.
List as discussed in [[jtopic:455746]] by [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=67439 PhilD] editing by [http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 Mandville]

----
[[Category:Security]]
[[Category:Security_FAQ]]

----

Archived:Summer of Code 2009 Project Ideas

2009-03-22T16:54:55Z

Hidabe: /* Joomla Multisites */

[[Image:Gsoc_2009_logo.png|right]]

===Welcome!===
Welcome to the Joomla! Google Summer of Code (GSoC) 2009 project ideas page. As we move forward with the 2009 version of the Joomla! GSoC, we will use this page to develop possible project ideas. Please note that anyone who is interested can participate in this process. You do not have to be a GSoC student or mentor to suggest possible project ideas. Thanks!

===Ideas===

=====Advanced Poll/Survey Suite=====

The core polls extension has been removed from Joomla! 1.6. Develop a fully featured poll/survey suite that will allow relatively simple user polls and the collection of complex anonymized survey data authenticated against either the Joomla users database or an external database. Possibly look to [http://limesurvey.org/] as a model or integration.

:'''Mentor:''' Wilco Jansen (subject to change)
:'''Skills:''' Joomla CMS framework, MVC, PHP 5.2, MySQL
:'''Difficulty:''' medium

=====Full Frontend Editing=====

Right now we only have frontend editing for articles, there are a few improvements I can propose
* Article editing is done in a modal popup
* Edit module content and params from frontend (Editing done via a modal popup?)
* Article Title - edit in place
* Create some kind of a library function which allows easy frontend editing for any value (This will need some thought)

:'''Mentor:''' Akarawuth Tamrareang (subject to change)
:'''Skills Needed:''' Javascript, Joomla! Framework
:'''Difficulty:''' Hard

=====Template Manager Improvements/Advanced Template Manager=====

Extend the template manager so that it providers an better environment for template creation and modification. Improvements might include:
*expanded tool bar, including copy for a complete template
*access to the media manager
*access to all template files (not just css and index.php)
*override manager
*integration of an editor with code highlighting (such as codepress)
*support for template parameter groups
*remove hard-wired references to template name from the core templates (so the new copy function will work as expected)
*"export" button on the toolbar which will create a zip package file containing the template (also fixes any errors in the templateDetails.xml file as it goes).

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Work Flow Extension=====

Create a 1.6 Extension to flexibly manage workflow for com_content.
Ideally it should be extensible to other components, but com_content should be used as the proof of concept.
Work flow should manage the publication process, including assignment of editors or publishers to specific content items, notifications of relevant actions to specific individuals or groups, change of status to block author editing of published work.

As much as possible administrators should be able to construct their own work flows.

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Page Versioning Extension=====

Create a 1.6 content versioning extension with the goal that this work could be integrated into the core Joomla CMS for future releases.
The Page Versioning Extension will allow the ability for frontend and backend content users to be able to save and re-publish/revert previously saved versions of content items that they have access to.

Further user permissions could be introduced in order to restrict access to this overall feature.

Features could include a visual and html code difference between the current and previously saved versions, as well as general searching data such as dates and time of previous saved entries of that content.

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Taxonomy Extension=====

Create a 1.6 Taxonomy extension with the goal that this work could be integrated into the core Joomla CMS for future releases.
The Taxonomy Extension will allow the ability to organise content for classification, improving on the current Section and Categories classification.

Taxonomy is a vital feature of modern CMS solutions, evolving from the previous "pigeonholeing" of a content item.
Full organisational structures and multi tagging of content could be included, including powerful search functions of content under those classifications.

Taxonomy is a missing feature in Joomla!, which another open-source competitor product currently offers. We have seen a number of opportunities when Joomla! misses out on being the chosen option for a CMS due to the lacking of this feature.

:'''Mentor:''' Allan Walker (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Keywords Management Extension=====
Keywords in articles are an important part of many Joomla! sites. They are used for page rankings but also can be used with Related Articles modules and component extensions. In this capacity, they provide a way to relate articles that is much more flexible and free-form than the built-in Section / Category / Article hierarchy.

Currently in Joomla!, keywords are entered when editing each individual article. This has several disadvantages, including:
* You cannot see already existing keywords when entering in keywords for an article.
* You cannot see existing articles that are already associated with a keyword.
* It is difficult to be consistent when using keywords. For example, should it be capitalized, singular or plural ("Dog" or "Dogs"), and so on.

To deal with these issues, a back-end Keyword Management extension is proposed. This extension would allow the following capabilities:
* A management screen showing a list of all keywords currently in use. This would provide the ability to drill into any keyword and see all articles that use this keyword.
* A keyword picker screen. This would allow an author to pick keywords for an article from a list of existing keywords. This would make it easier to ensure consistency in spelling, capitalization, and usage between keywords. This screen would also allow the author to add a new keyword to the list.
* The ability to do global search and replace on keywords.
* The ability to see keywords ranked by frequency of use.
* The ability to list articles to which no keywords have been assigned.

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====User-Defined List and Blog Layout Extension=====
Currently in Joomla!, there are built-in Menu Items for list and blog layouts for Sections and Categories. However, the way a list of articles is selected is tightly bound with the way the list is displayed on the page. In theory, you should be able to have a list or blog layout that shows any selection of articles.

To provide this capability, an extension is proposed that would provide layouts similar to the current list and blog layouts. However, the extension would be designed so that the list of articles is provided by a plugin instead of being integrated into the layout. Example plugins could be provided to mimic the current Section, Article, and Front Page layouts. However, the power of this extension is that the user could add their own plugin that would provide a list of articles using any type of query. This list of articles would then feed into the built-in layouts provided by the extension to turn the raw article list into the desired layout.

:'''Mentor:''' Ian MacLennan(subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Hard

=====Improve Unit Test Coverage=====
Work has been started on this but the number of unit tests currently in use is small. We need to add many more unit tests. Also, currently unit tests are only able to be used for class methods. We have no way, for example, to test page layouts or module insertion into templates. Part of this project could be to research automated testing solutions to test the complete HTML code sent to the browser. This would allow end-to-end automated testing.

:'''Mentor:''' Alan Langford (subject to change)
:'''Skills Needed:''' PHP, PHPUnit, Joomla! Framework
:'''Difficulty:''' Medium

=====Web Based Unit Test Runner=====
Write a test runner that makes it easy to run unit tests from a web browser. The existing unit test framework is based on running PHP from the command line. While this is essential for integrating testing into the build and release process, it's a barrier to using tests during development.

This project involves adapting web-based test runners provided by PHPUnit to support the "Joomla!" testing environment.

:'''Mentor:''' Alan Langford (subject to change)
:'''Skills Needed:''' PHP, PHPUnit, Joomla! Framework
:'''Difficulty:''' Hard

=====CiviCRM Integration: Plugins to Expose the CiviCRM API to the Joomla! Front End=====
[http://civicrm.org/ CiviCRM] is a powerful constituent relationship management system designed for the not-for-profit/nongovernmental organizations. It currently integrates with Joomla! and the 2.2 version is native to Joomla! 1.5.

CiviCRM has a rich API only small parts of which are currently easily accessible from the Joomla! front end. Create a series of plugins that allows the flexible and highly integrated use of the CiviCRM API in Joomla Content, modules, and other core and non-core extensions (such as com_user, com_contact_diretory or calendaring components).

For this project the student should plan on interacting closely with both the Joomla! and CiviCRM teams.

:'''Mentor:''' Elin Waring (subject to change)
:'''Skills Needed:''' PHP, CiviCRM Framework, MySQL, Joomla! Framework
:'''Difficulty:''' Hard

=====CiviCRM Integration: Develop Front End Extensions for CiviCRM Data=====
Develop a suite of front end Joomla! 1.5 extensions (modules, plugins and a Joomla! style MVC front end component) for CiviCRM.

[http://civicrm.org/ CiviCRM] is a powerful constituent relationship management system designed for the not-for-profit/nongovernmental organizations. It currently integrates with Joomla! 1.0.x and 1.5 in legacy mode, and and the 2.2 version is native to Joomla! 1.5.

Thus far most functionality for CiviCRM in Joomla! has focused on the administrator. This project will focus on fuller development of the CiviCRM Joomla! front end.

This development might include modules, plugins, and a MVC front end component which will allow exposure of various CiviCRM APIs as well as allowing Joomla! users the ability to use template overrides and other ways of controlling design and functionality in ways they are familiar with.

The core of this project will be the completion of a Joomla! MVC front end component for existing front end functionality, the basic skeleton for which has been incorporated in CiviCRM 2.2.

Additional items might focus on modules and views to display information.

Some of these will focus on the display of and interaction with general information, for example:
* a module showing a list of upcoming events,
* a module showing progress on a fund raising thermometer,
* a module displaying the most recent donations, donations at certain levels, total donations or other information,
* a module containing a contribution button linked to a specific contribution page,
* a donation reporting view with a layout that displays lists of donors in a given time period, sorted by giving level.

Some will focus on the display of user level information such as:
* a module displaying an individual's information from a given profile with the option to update,
* a module displaying an individual's summary giving information,
* a module displaying events an individual is registered for.

:'''Mentor:''' Elin Waring (subject to change)
:'''Skills Needed:''' PHP, CiviCRM Framework, MySQL, Joomla! Framework
:'''Difficulty:''' Hard

=====CiviCRM Integration: Development of Multilingual Functionality=====

[http://civicrm.org/ CiviCRM] is an open source constituent relationship management system used by NGOs and advocacy groups (like Amnesty International, Wikimedia Foundation or the Joomla! and Drupal projects) all over the world. Judging by the number of community-contributed and -maintained translations and civicrm.org statistics, CiviCRM installations exist in over twenty languages using various alphabets (Latin, Cyrillic, Arabic, Devanagari, Chinese). Multi-language support is essential in multilingual countries (like Canada or India), as well as in cross-border (e.g., Central and East European) and worldwide organizations.

For this project the student will extend the multilingual features of CiviCRM (initially created during Google Summer of Code 2008), including (but not limited to) some/all of the following:
* internationalization of further CiviCRM fields,
* new, database-based framework for handling translations (partially replacing the existing gettext solution),
* a solution for proper localization of the initial database seed, according to initial language selection (enumerable values, etc.),
* changes to CiviCRM upgrade process which will make it work transparently on multilingual sites (as opposed to the current explicit handling of multilingual sites),
* changes to CiviCRM’s translations portal easing translators’ work,
* multilingual demo installation for translators, picking up new translations “on the fly”,
* an automatic engine porting translation strings between CiviCRM releases.

:'''Mentor:''' Wes Morgan (subject to change)
:'''Skills Needed:''' PHP, CiviCRM Framework, MySQL, Joomla! Framework
:'''Difficulty:''' Hard

=====CiviCRM Integration: Multi-Organizational Access Control Lists=====
[http://civicrm.org/ CiviCRM] is an open source constituent relationship management system used by small and large NGOs and advocacy groups, some of them spanning across many smaller (and not-so-small) organizations and/or divided into subgroups, chapters, etc.

The goal of this project is to extend the current CiviCRM ACL capabilities to cover the needs of such multi-part organizations, as well as CiviCRM installations that span across many organizations (with various strengths of ties between them).

The new ACL features should include (but not be limited to):
* optional inheritance of access right between related organizations and related sub-organizations,
* creation and sane management of functional groups on various levels of the (sub-)organization graph (“volunteer coordinator for East US chapters of Org X”, “coordinator of campaign Y across all orgs”, etc.),
* scalability of the designed ACL system – performance-wise,
* scalability of the designed ACL system – manageability-wise.

:'''Mentor:''' Wes Morgan (subject to change)
:'''Skills Needed:''' PHP, CiviCRM Framework, MySQL, Joomla! Framework
:'''Difficulty:''' Hard

=====Improved Error Handling=====
Create a component that will handle standard errors (ex. 404) so that headers are sent for the error code, but the error is trapped and redirected from the error.php file back to Joomla!
where it can be handled on a normal webpage.

:'''Mentor:''' Wilco Jansen (subject to change)
:'''Skills Needed:''' PHP, Joomla! Framework
:'''Difficulty:''' Medium

=====Media Manager Improvements=====
The following improvements could be made to the current Joomla! Media Manager:
* Support content expiration (image/video) that allow user to set start – end date of each content which to be lived on site
**e.g. food image can be lived on site only 3 months, due to the license issue, so we need to take out the image and replace it with other default image or leave it blank
* Support user friendly input interface which allow user to complete content input in 1 screen (Text input, Multiple images/videos upload, Tagging, Mapping related content and so on)

:'''Mentor:''' Akarawuth Tamrareang (subject to change)
:'''Skills Needed:''' PHP, Javascript, Joomla! Framework
:'''Difficulty:''' Hard

=====Whiteboard/Wiki Component=====
Joomla comes with a few core components, and a Whiteboard/Wiki component would be a great addition to those. It would be a basic implementation of the feature with the following possible features:

* Provide a simple interface for editing (perhaps allowing multiple users to edit at once or locking down while under edit)
* Ability to restrict user access on posting
* Organize whiteboards
* Keep revisions in archive

:'''Mentor:''' Ashwin Date (subject to change)
:'''Skills Needed:''' PHP, Javascript, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Core Extensions Semantic and SEO Updates=====
The core extensions can be modified to produce semantic markup. The tables should be replaced withmore appropriate containers for the contents. This would not replace the need for template overrides, but rather make the default output stronger to build upon. The output should also be arranged to best suit the content in the majority of situations. Perhaps also a basic system reset CSS file would need to be developed to set some of the basic layout items, also to be easily disabled.

The core output cannot be replaced completely without causing many 1.5 templates to break. Therefore it would be necessary to
either have a legacy mode for templates or to automatically detect the template type (1.5 or 1.6) in order to provide the right output.

Modules can be defined in a template to have pretty much any name they wish. While this is great for template makers, it would be good to have at least some guidelines about naming modules. Module names like user1 and user2 are essentially useless semantically, and to administrators of a site. Some templates are designed for any module to fit in any position, but in general there are at least a handful that are designed with the menu, footer, and other aspects in mind. Perhaps Joomla can create some guidelines (not requirements) related to this.

:'''Mentor:''' Allan Walker (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Templates for Joomla 1.6=====
Each version of Joomla comes with a set of templates, and they are updated with each major release. 1.6 is currently in development, and will need a new set of templates. These templates should:

* Employ semantic markup
* Provide a fresh look
* Be flexible to accommodate all kinds of content
* Come with example core overrides, perhaps for major extensions as well
* Should have a light memory print
* Comply with accessibility standards
* Validate
* Be easily modified and built upon

:'''Mentor:''' Allan Walker (subject to change)
:'''Skills Needed:''' PHP, HTML, CSS, Joomla! Framework
:'''Difficulty:''' Medium

=====Administrator and Usability Improvements=====
There are many little improvements that would help with general usability and administration for Joomla users.

* Assigning modules in the Menu Manager
* Assigning links from Article Manager
* Copying templates
* Easily change Control Panel icons
* Improved Front Page article handling
* Improve internal mailing system and its notifications
* Make Control Panel in the menu a one click step, not hover then select
* Have the main tabs linked in case they are clicked, such as Content goes to Articles

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, Javascript, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Content Item Templates=====

Easy page layout template system so that editors can choose from a pre-defined range of layouts.
This could be useful when certain pages all require the Name, Date, Author name, photo in a certain area, tagline etc.
Content item templates could be defined, then saved and authors could then choose from this list, helping sites with larger article content to retain continuity throughout their areas of pages.

:'''Mentor:''' Allan Walker (subject to change)
:'''Skills:''' Joomla CMS framework, MVC, PHP 5.2, MySQL
:'''Difficulty:''' medium

=====XML DTDs and XML Schemas for all XML files used in Joomla=====

XML files are used in various places throughout Joomla. Historically, the installer XML files have had DTDs against which they can be validated. However, there are a number of known issues with these DTDs and there are other XML files used in Joomla that have never had DTDs written at all. Furthermore, DTDs can only catch certain classes of errors within XML files and we need to look beyond DTDs to look at XML Schemas to catch other classes of errors.

* Review all XML files used in Joomla and list them on the documentation wiki.
* Create a collection of test cases of XML files that will fail in Joomla and which should, therefore, fail to validate in some way.
* Where DTDs already exist, review, revise and update them as necessary.
* Create DTDs for those XML files that don't currently have one.
* Create patches for the core code (target 1.6?) to ensure that valid DTDs can be written for all XML files.
* All current DTDs force some XML elements to appear in a particular order which is neither enforced nor required by Joomla. If possible, solve this problem so that designers and developers can place those elements in arbitrary order in the XML and still have the XML files validate against the DTDs.
* Create XML Schemas for all XML files used in Joomla.
* Ensure that DTDs and XML Schemas are well commented and/or thoroughly documented.
* Write comprehensive documentation covering the process of validating an XML file against both DTDs and XML Schemas. Some documentation already exists that can be used as the basis for this.
* Expand the collection of test cases to include XML files that will not fail in Joomla but which may or may not fail to validate against the DTDs or XML Schemas.
* Ensure that the test case collection is properly documented so that changes to Joomla and/or the DTDs and XML Schemas can be properly tested.

:'''Mentor:''' Chris Davenport (subject to change)
:'''Skills:''' Joomla CMS framework, XML / DTD validation
:'''Difficulty:''' Medium

=====Alternate Component for Editing Articles=====
The idea is to have an component on admin side that allows articles to be edited based on the frontend navigation, Something similar to [http://thewebkitchen.co.uk/typo3temp/pics/a367ba3c04.jpg Typo3 admin]implementation (just 2 and 3 in the image).

:'''Mentor:''' Amit Kumar Singh (subject to change)
:'''Skills:''' Joomla CMS framework, MVC, PHP 5.2, MySQL
:'''Difficulty:''' medium

=====Magento eCommerce Platform integration into Joomla!=====
Magento is an actively developing award winning open source eCommerce platform. The idea is to develop a bridge between Magento and Joomla.
More info about Magento can be found from the following websites:
[http://www.magentocommerce.com/ Magento official website]
[http://demo.magentocommerce.com/ Magento online demo]
[http://www.magentocommerce.com/media/tour/magento-tour-store/view Store tour video]
[http://www.magentocommerce.com/media/tour/magento-tour-admin/view Admin tour video]
[http://www.infoworld.com/slideshow/2008/08/168-best_of_open_so-8.html Best of Open Source Enterprise Applications]

:'''Mentor:''' Not assigned yet
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework
:'''Difficulty:''' Hard

=====Xinha WYSIWYG editor for Joomla! frontend and backend editing=====
Xinha is a powerful WYSIWYG editor, which supports plugins. So administrator can customize their working environment and even write their own plugins.
The idea is to integrate Xinha into Joomla! with ability of editing content from frontend and backend. The editor environment must be configurable, output
HTML code must be W3C compliant, for that we will need also to implement [http://htmlpurifier.org/ HTMLPurifier] plugin into Xinha.

You can try [http://edo.webmaster.am/projects Xinha editor plugin demo] for Joomla! 1.5.
More info about Xinha can be found from the following websites:
[http://xinha.webfactional.com/ Xinha official website]
[http://xinha.raimundmeyer.de/x_examples/ext_example.html Xinha demo]
[http://xinha.webfactional.com/wiki/Plugins Currently available Xinha plugins]

:'''Mentor:''' Not assigned yet
:'''Skills Needed:''' PHP, JavaScript, Joomla! Framework
:'''Difficulty:''' Medium

=====Working copy of Joomla! live site=====
Usually administrators are working on their live site directly and sometimes they do mistakes as all people do. Usually the live site get's messed after extension installation/uninstallation process and re-configuration. The idea is to have a working copy of the live site and make changes to it, then if everything is okay after some testing, you can approve changes and the tool will synchronize changes to your live site.

Some of the steps, which will need to be done to complete this project:
* Develop a tool, which will create a working copy of the site
* Develop a tool, which will synchronize working copy with the live website
* Develop a diff tool, which will show not approved changes
* Interface in working copy to view not approved changes with possibility to reject or approve specified changes

:'''Mentor:''' Sam Moffatt (subject to change)
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework
:'''Difficulty:''' Medium to Hard

=====Elgg Platform integration into Joomla!=====
Elgg was providing an elegant and powerful solution for anyone who wants to create their own online community. Elgg is free and open source and powers all kinds of social networks - from education and business to martial arts and rugby. If you are looking for a professional social intranet or just want to run a site for your fishing club, Elgg is a great choice. The idea is to develop a bridge between elgg and Joomla.
More info about elgg can be found from the following websites:
[http://www.elgg.org/ elgg official website]
[http://community.elgg.org/ elgg community online ]
[http://docs.elgg.org/wiki/Main_Page elgg Documentation]

Some of the steps, which will need to be done to complete this project:
* synchronize user between elgg and Joomla!
* develop module for Joomla! to show Users Activity
* develop module for Joomla! to show Members photo from Elgg

:'''Mentor:''' Pisan Chueachatchai, Akarawuth Tamrareang (subject to change)
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework
:'''Difficulty:''' Medium

=====New Extension Install Manager=====
Update Systems presently doesn't have an easy to navigate structure for handling the large amount of information that is potentially available when a user wishes to install new extensions into their system backed from the update system. Updates are presented already and temporarily uninstalled items are also displayed as a technology demonstration of what can be achieved using the new system.

A completely new look extension install manager is required to help make meaning of the information that the update system exposes. In part this system should also expose information about existing installed extensions in the system (including any pending updates they might have) as well as new extensions that are available. Its purpose should be similar to the way that "Synaptic" works on Debian or Ubuntu operating systems.

The majority of the data loading framework is build already permitting the enterprising developer to focus primarily on interfacing with the installer system and building a useful user interface to make containing these extensions very easy.

Areas of further development involve research involving the development of a Firefox plugin (or similar) that stream lines installing Joomla! extensions from a web site perhaps similar to the way that Firefox is handled. This would involve developing a service that facilitates authenticated remote installation procedures.

:'''Mentor:''' Sam Moffatt (subject to change)
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework
:'''Difficulty:''' Medium

=====Update Server=====
With the development of the new infrastructure there is a need to create an independent update server to make a developer's life easier when installing creating extensions. The update server should in part offer a download facility where users can download directly from it via a front end Joomla! component as well as something that will generate XML files statically on the file system and dynamically dependent on the administrator's choice. The XML files should be generated in the defined format that already exists and should handle updating automatically.

Expanding on the system it should be able to push notifications out through an extensible plugin system as well as handle automatic mirroring of the files (again via plugins). An example of a notification plugin could be something that automatically updates the JED or posts a new article in a specific category with changelog information. An example of a mirror plugin could be something that automatically uploads files to a release on JoomlaCode, perhaps even creating the release automatically as well. The location of generated XML files should be configurable as well and may also be requested to be uploaded to external resources as well (e.g. a mirror server for the XML update files).

The application should make the most of new features introduced into Joomla! 1.6 such as the Forms API to provide plugin customisable interfaces to various systems.

An extension of this would be the provisioning of content plugins that handle the integration of download URL's and version numbers for packages that are handled through the system to allow Joomla! content items to interact with the system in a flexible manner.

Proxy functionality would also be desirable to have the update server function as a slave to other sites and permit updates through a proxy. This would also involve a method for mirroring the binary files onto the proxy server as well but has some interesting different functionality to the main project.

:'''Mentor:''' Sam Moffatt (subject to change)
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework
:'''Difficulty:''' Medium

=====Authentication Systems=====
This is a major project consistent of various subparts. It should be undertaken by someone with at least a basic understanding of how Joomla! operates and developing for Joomla!. This is not a good starter project. Students should show an interest in this area and be happy to work in an agile method with tighter deadline for individual projects to come together as a final assessable package. A combination of options might be selected but at least three should be considered.

This is still in moderate draft phase.

* Group Mapping Group Mappings is a feature that permits external groups to be mapped onto Joomla! groups when the user logs into the system. Implementation of the data retrieval aspect of this project isn't required however implementation of a user interface to control group mappings is required. The system should permit the administrator to designate that a specified group name string should map to a given user group. Optionally settings may be given priorities to enable mapping of "primary" groups to the user. This project is Joomla! 1.6 only and includes work on the new ACL system that permits multiple groups.

* LDAP Authentication Groups Discovery Tied in with group mapping the LDAP authentication plugin should then become capable of determining the groups that a user is a member of and reporting this back to the parent system. This will probably be in DN form which is why the group mapping application is useful.

* LDAP User Plugin Presently I have an LDAP user plugin that permits Joomla! to push users details into LDAP. Ideally this could be expanded to handle groups as a general improvement to the entire user subsystem. Extra user fields should also be populated some how as well. Ideally it should be made into a configurable so that mappings could be made arbitrarily however 'templates' for individual directory systems (MSAD, eDirectory, SunOne, OpenDirectory, plain OpenLDAP inetOrgPerson).

* LDAP ACL Backend This would permit ACL changes to be pushed into LDAP which can then be copied into different Joomla! sites periodically permitting centralised control as well as more generalised ACL systems to hook into Joomla!.

* Pluggable Authentication Requests Developers should be able to request authentication to occur and then be redirected back to where they are. This authentication system should be pluggable to permit different handlers to be implemented. For example a default plugin would be Joomla!'s Login Form however another authentication fall back might push you through SSO instead and then fall back to the login form.

* External SSO Authentication Hook Build an external authentication system that permits login hooks into the system outside of the primary site similar to how Moodle handles its authentication. This would aide non-obtrusive SSO authentication requests integrated with the above Pluggable Authentication Requests system without having to go through an entire potential request to Joomla!. This should be a lot more cut down than a full application load and would involve the development of a smaller application to handle this with a slightly different style to what is normally used and could be considered a 'harder' project than the rest.

:'''Mentor:''' Sam Moffatt (subject to change)
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework, LDAP (for some).
:'''Difficulty:''' Medium

=====Adminlist library for Joomla! Developers=====
Many developers create new components every day all over the world. The idea is to develop a library for rendering lists of items in the administration panel (like standard lists of users/articles/categories/etc). It must handle all routine work of creating such lists for components.

It should work like a common form creator class. You set list of fields with their types (columns) and list of values (rows) or an SQL-query to fetch them.

The main features of the library should be:

* Different column types (at least text, link, edit link, publish, order, logical and date types).
* Inputs for data filtering.
* Ability to set columns from either the php array or the xml file (this to be discussed).
* Ajax support for the following tasks: publish/unpublish, order up/order down, save ordering, filtering, sorting by columns.
* Quick edit mode to change some data on fly without entering item’s edit page.

:'''Mentor:''' Oleg Nesterov
:'''Skills Needed:''' PHP5, OOP, MySQL, JavaScript, Ajax, and some base knowledge of Joomla! Framework
:'''Difficulty:''' Medium

=====Web Links Component Upgrades=====

Add a new feature that could expand on the basic web links feature to allow users to submit links and then rate them. It could emulate some of the main features of digg.
* Expand the submit links feature
* Provide a ranking functionality
* Produce modules
* Plugin to connect with each article written to be included in the ranking
* Ability to accept submissions from external sites or widgets

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Make it easier to Extend Editors=====
Currently it is very difficult to extend TinyMCE and other editors by using JavaScript plugins that are available for them. Idea is to make this process easier by allowing Joomla plugins to extend editors. We already have something similar on WordPress backend, which allows us to easily extend the TinyMCE editor using WordPress plugins.

:'''Mentor:''' Amit Kumar Singh (subject to change)
:'''Skills:''' JavaScript, Joomla CMS framework, MVC, PHP 5.2
:'''Difficulty:''' Hard

=====Site Cloner=====
This project involves building a tool that will take an existing site (probably HTML but could be partially dynamically generated) and feature the ability to suck it into Joomla!, stripping the template as it goes and attempting to rebuild the navigation structure whilst also maintaining as much metadata as possible. This project requires exceptional programming skill, a deep knowledge of the Joomla! CMS, and someone with a knack for solving weird problems. An analogous module exists for Drupal in its "[http://drupal.org/project/import_html Import HTML]" and might serve as a good location for study of ideas and concepts.

:'''Mentor:''' Sam Moffatt (subject to change)
:'''Skills:''' Joomla CMS framework, MVC, PHP 5.2
:'''Difficulty:''' Very Hard

=====Typography Plug-in=====
''Introduction''

Typography (''Etymology: typos ⎯ type, graphos ⎯ written'') is the art and techniques of arranging type, type design, and modifying type glyphs ([http://en.wikipedia.org/wiki/Typography en.wikipedia.org/wiki/Typography]).

Typography is an important part of any text design. It makes texts look better, more sophisticated, and professional. It was a must for all books, newspapers, and other printed text sources at the times when computers did not exist or were not widely spread and the texts were set up by professionals only. Nowadays 99% of texts are created not by professionals and the quality of typography leaves much to be desired.

I agree with those who say that it’s just a small detail but details is something that makes things perfect. As a musician must play from music, a HTML coder must take into account typography rules of text formatting although in both cases most people may not notice any benefits.

At the age of content management systems most texts are set up by common users and the typography issue has become even more visible. This problem can be at least partially solved by involving automated typography scripts while preparing texts for displaying on a web page.

''Goal''

The goal is to create Joomla! CMS plug-in that would format texts correctly according to typography rules of different languages without any loss of page display speed.

The plug-in would be used to fix primes, opening and closing quotes, apostrophes; to fix dashes, and other punctuation; to insert spaces and correct special symbols such as Copyright, Registered, Trademark, and others; to fix parentheses, brackets, angle brackets, and guillemets; to format numbers; to add no-break symbols when necessary, and more. In addition it would be used to handle such issues as quotes within quotes, and others.

Here are two examples from [http://everything2.com/title/rules%20of%20typography everything2.com] to illustrate the way the correctly formatted text would look:

* En français: Einstein a (peut-être) dit : « J’adore 3,14, 298 000 — et 42 ! ».
* In English: Einstein said: “3.14, 298,000—and 42—are my all-time favourite numbers!”

As you can see, it’s not only a matter of replacing certain symbols with their ‘correct’ versions. Everything is much more complicated, I’d say it’s a challenge :)

''Previous Attempts''

There are quite a few typography plug-ins for Joomla! CMS but none of them is actually intended to format texts correctly. Each of those does certain tricks like inserting special symbols but none is even close to making the whole thing.

''Functional Requirements''

The functional requirements in brief can be as follows:

* The plug-in must adjust text formatting according to typography rules of supported languages.
* The plug-in must work really fast. Probably, regular expressions would work too slowly since there are pretty many typography rules and it would be necessary to create some lexical analyzer working without regular expressions.
* The plug-in must be scalable so that it must be relatively easy to add new rules for all or only for certain languages. Of course it’s not supposed to be done by end users but still it must be clear and not too complicated for programmers.

Open Issues:

* The plug-in might need cache functionality to speed up front-end pages displaying.

''Related Links''

* [http://en.wikipedia.org/wiki/Typography en.wikipedia.org/wiki/Typography]
* [http://everything2.com/title/rules%20of%20typography Rules of Typography]
* [http://webtypography.net/toc/ The Elements of Typographic Style Applied to the Web]
* [http://www.languagegeek.com/typography/apostrophes.html Apostrophes in Native Languages]
* [http://www.wpdfd.com/issues/23/typography/ Typography]

:'''Mentor:''' Andrey Mishenin
:'''Skills:''' PHP, OOP, Joomla! CMS Framework, experience with lexical analyzers coding would greatly help
:'''Difficulty:''' Hard

=====Page Title Tags Enhancement=====
Enhance title tags management in Joomla! for SEO purposes. This is first of all related to the content component that doesn’t handle titles perfectly at this time.

The idea is to allow forming titles basing on the following:

* Website name (optional)
* Current section and/or current category name (optional)
* Keywords for current section and/or current category (optional)
* Current article title

There should be ability to choose a separating symbol: “/”, “⎯”, etc. and the above mentioned items order in the title tag.

:'''Mentor:''' Andrey Mishenin
:'''Skills:''' PHP, OOP, MySQL, Joomla! CMS Framework
:'''Difficulty:''' Relatively easy

=====Joomla Multisites=====

Recently, i needed develop one Joomla portal where users could create own sites easy and fastly.
For it, i build one small Multisite Master Component that do database reply, create link to Joomla slave directory and more.
I have table as:
* Title -> site 1
* Description -> Description of my site...
* User_id -> 67
* Url -> http://tom.yoursite.com
* Db_name -> slavesite_tom
* Db_user -> tom_userdb
* Db_pass -> mypass
* Pack_id ->12 (This indicates what slave directory and SQL for copy, i have other table with information for it).
* etc

In Joomla slave configuration.php I have implemented contructor function, where I load Master DB information, and I do comparation URL with it. After, i initialize JConfig fields with it (title = title of site, description = metadata, etc...)

So, i had good multisites system.

But i think that could to be better:
* Write new code for Master Component and configuration.php slave sites. (in my old version, i have one include to external php file in constructor, this php file rewrite JConfig variables)
* Creation slave site using only PHP (in my old system, using sh file, dont window server soport).
* Posible Front-Site component for user creator, that let you change template and other minors admin features.
* Soport multiple slaves type sites. Now only: reply DB and same files. We can more options: share users DB, dont share files (real copy of joomla slave directory), etc.
* And more?

:'''Mentor:''' none?
:'''Skills Needed:''' PHP, mySQL, Apache (lighttpd, etc) servers, Joomla! Framework
:'''Difficulty:''' Medium-Hard

Archived:Summer of Code 2009 Project Ideas

2009-03-22T16:52:54Z

Hidabe:

[[Image:Gsoc_2009_logo.png|right]]

===Welcome!===
Welcome to the Joomla! Google Summer of Code (GSoC) 2009 project ideas page. As we move forward with the 2009 version of the Joomla! GSoC, we will use this page to develop possible project ideas. Please note that anyone who is interested can participate in this process. You do not have to be a GSoC student or mentor to suggest possible project ideas. Thanks!

===Ideas===

=====Advanced Poll/Survey Suite=====

The core polls extension has been removed from Joomla! 1.6. Develop a fully featured poll/survey suite that will allow relatively simple user polls and the collection of complex anonymized survey data authenticated against either the Joomla users database or an external database. Possibly look to [http://limesurvey.org/] as a model or integration.

:'''Mentor:''' Wilco Jansen (subject to change)
:'''Skills:''' Joomla CMS framework, MVC, PHP 5.2, MySQL
:'''Difficulty:''' medium

=====Full Frontend Editing=====

Right now we only have frontend editing for articles, there are a few improvements I can propose
* Article editing is done in a modal popup
* Edit module content and params from frontend (Editing done via a modal popup?)
* Article Title - edit in place
* Create some kind of a library function which allows easy frontend editing for any value (This will need some thought)

:'''Mentor:''' Akarawuth Tamrareang (subject to change)
:'''Skills Needed:''' Javascript, Joomla! Framework
:'''Difficulty:''' Hard

=====Template Manager Improvements/Advanced Template Manager=====

Extend the template manager so that it providers an better environment for template creation and modification. Improvements might include:
*expanded tool bar, including copy for a complete template
*access to the media manager
*access to all template files (not just css and index.php)
*override manager
*integration of an editor with code highlighting (such as codepress)
*support for template parameter groups
*remove hard-wired references to template name from the core templates (so the new copy function will work as expected)
*"export" button on the toolbar which will create a zip package file containing the template (also fixes any errors in the templateDetails.xml file as it goes).

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Work Flow Extension=====

Create a 1.6 Extension to flexibly manage workflow for com_content.
Ideally it should be extensible to other components, but com_content should be used as the proof of concept.
Work flow should manage the publication process, including assignment of editors or publishers to specific content items, notifications of relevant actions to specific individuals or groups, change of status to block author editing of published work.

As much as possible administrators should be able to construct their own work flows.

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Page Versioning Extension=====

Create a 1.6 content versioning extension with the goal that this work could be integrated into the core Joomla CMS for future releases.
The Page Versioning Extension will allow the ability for frontend and backend content users to be able to save and re-publish/revert previously saved versions of content items that they have access to.

Further user permissions could be introduced in order to restrict access to this overall feature.

Features could include a visual and html code difference between the current and previously saved versions, as well as general searching data such as dates and time of previous saved entries of that content.

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Taxonomy Extension=====

Create a 1.6 Taxonomy extension with the goal that this work could be integrated into the core Joomla CMS for future releases.
The Taxonomy Extension will allow the ability to organise content for classification, improving on the current Section and Categories classification.

Taxonomy is a vital feature of modern CMS solutions, evolving from the previous "pigeonholeing" of a content item.
Full organisational structures and multi tagging of content could be included, including powerful search functions of content under those classifications.

Taxonomy is a missing feature in Joomla!, which another open-source competitor product currently offers. We have seen a number of opportunities when Joomla! misses out on being the chosen option for a CMS due to the lacking of this feature.

:'''Mentor:''' Allan Walker (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Keywords Management Extension=====
Keywords in articles are an important part of many Joomla! sites. They are used for page rankings but also can be used with Related Articles modules and component extensions. In this capacity, they provide a way to relate articles that is much more flexible and free-form than the built-in Section / Category / Article hierarchy.

Currently in Joomla!, keywords are entered when editing each individual article. This has several disadvantages, including:
* You cannot see already existing keywords when entering in keywords for an article.
* You cannot see existing articles that are already associated with a keyword.
* It is difficult to be consistent when using keywords. For example, should it be capitalized, singular or plural ("Dog" or "Dogs"), and so on.

To deal with these issues, a back-end Keyword Management extension is proposed. This extension would allow the following capabilities:
* A management screen showing a list of all keywords currently in use. This would provide the ability to drill into any keyword and see all articles that use this keyword.
* A keyword picker screen. This would allow an author to pick keywords for an article from a list of existing keywords. This would make it easier to ensure consistency in spelling, capitalization, and usage between keywords. This screen would also allow the author to add a new keyword to the list.
* The ability to do global search and replace on keywords.
* The ability to see keywords ranked by frequency of use.
* The ability to list articles to which no keywords have been assigned.

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====User-Defined List and Blog Layout Extension=====
Currently in Joomla!, there are built-in Menu Items for list and blog layouts for Sections and Categories. However, the way a list of articles is selected is tightly bound with the way the list is displayed on the page. In theory, you should be able to have a list or blog layout that shows any selection of articles.

To provide this capability, an extension is proposed that would provide layouts similar to the current list and blog layouts. However, the extension would be designed so that the list of articles is provided by a plugin instead of being integrated into the layout. Example plugins could be provided to mimic the current Section, Article, and Front Page layouts. However, the power of this extension is that the user could add their own plugin that would provide a list of articles using any type of query. This list of articles would then feed into the built-in layouts provided by the extension to turn the raw article list into the desired layout.

:'''Mentor:''' Ian MacLennan(subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Hard

=====Improve Unit Test Coverage=====
Work has been started on this but the number of unit tests currently in use is small. We need to add many more unit tests. Also, currently unit tests are only able to be used for class methods. We have no way, for example, to test page layouts or module insertion into templates. Part of this project could be to research automated testing solutions to test the complete HTML code sent to the browser. This would allow end-to-end automated testing.

:'''Mentor:''' Alan Langford (subject to change)
:'''Skills Needed:''' PHP, PHPUnit, Joomla! Framework
:'''Difficulty:''' Medium

=====Web Based Unit Test Runner=====
Write a test runner that makes it easy to run unit tests from a web browser. The existing unit test framework is based on running PHP from the command line. While this is essential for integrating testing into the build and release process, it's a barrier to using tests during development.

This project involves adapting web-based test runners provided by PHPUnit to support the "Joomla!" testing environment.

:'''Mentor:''' Alan Langford (subject to change)
:'''Skills Needed:''' PHP, PHPUnit, Joomla! Framework
:'''Difficulty:''' Hard

=====CiviCRM Integration: Plugins to Expose the CiviCRM API to the Joomla! Front End=====
[http://civicrm.org/ CiviCRM] is a powerful constituent relationship management system designed for the not-for-profit/nongovernmental organizations. It currently integrates with Joomla! and the 2.2 version is native to Joomla! 1.5.

CiviCRM has a rich API only small parts of which are currently easily accessible from the Joomla! front end. Create a series of plugins that allows the flexible and highly integrated use of the CiviCRM API in Joomla Content, modules, and other core and non-core extensions (such as com_user, com_contact_diretory or calendaring components).

For this project the student should plan on interacting closely with both the Joomla! and CiviCRM teams.

:'''Mentor:''' Elin Waring (subject to change)
:'''Skills Needed:''' PHP, CiviCRM Framework, MySQL, Joomla! Framework
:'''Difficulty:''' Hard

=====CiviCRM Integration: Develop Front End Extensions for CiviCRM Data=====
Develop a suite of front end Joomla! 1.5 extensions (modules, plugins and a Joomla! style MVC front end component) for CiviCRM.

[http://civicrm.org/ CiviCRM] is a powerful constituent relationship management system designed for the not-for-profit/nongovernmental organizations. It currently integrates with Joomla! 1.0.x and 1.5 in legacy mode, and and the 2.2 version is native to Joomla! 1.5.

Thus far most functionality for CiviCRM in Joomla! has focused on the administrator. This project will focus on fuller development of the CiviCRM Joomla! front end.

This development might include modules, plugins, and a MVC front end component which will allow exposure of various CiviCRM APIs as well as allowing Joomla! users the ability to use template overrides and other ways of controlling design and functionality in ways they are familiar with.

The core of this project will be the completion of a Joomla! MVC front end component for existing front end functionality, the basic skeleton for which has been incorporated in CiviCRM 2.2.

Additional items might focus on modules and views to display information.

Some of these will focus on the display of and interaction with general information, for example:
* a module showing a list of upcoming events,
* a module showing progress on a fund raising thermometer,
* a module displaying the most recent donations, donations at certain levels, total donations or other information,
* a module containing a contribution button linked to a specific contribution page,
* a donation reporting view with a layout that displays lists of donors in a given time period, sorted by giving level.

Some will focus on the display of user level information such as:
* a module displaying an individual's information from a given profile with the option to update,
* a module displaying an individual's summary giving information,
* a module displaying events an individual is registered for.

:'''Mentor:''' Elin Waring (subject to change)
:'''Skills Needed:''' PHP, CiviCRM Framework, MySQL, Joomla! Framework
:'''Difficulty:''' Hard

=====CiviCRM Integration: Development of Multilingual Functionality=====

[http://civicrm.org/ CiviCRM] is an open source constituent relationship management system used by NGOs and advocacy groups (like Amnesty International, Wikimedia Foundation or the Joomla! and Drupal projects) all over the world. Judging by the number of community-contributed and -maintained translations and civicrm.org statistics, CiviCRM installations exist in over twenty languages using various alphabets (Latin, Cyrillic, Arabic, Devanagari, Chinese). Multi-language support is essential in multilingual countries (like Canada or India), as well as in cross-border (e.g., Central and East European) and worldwide organizations.

For this project the student will extend the multilingual features of CiviCRM (initially created during Google Summer of Code 2008), including (but not limited to) some/all of the following:
* internationalization of further CiviCRM fields,
* new, database-based framework for handling translations (partially replacing the existing gettext solution),
* a solution for proper localization of the initial database seed, according to initial language selection (enumerable values, etc.),
* changes to CiviCRM upgrade process which will make it work transparently on multilingual sites (as opposed to the current explicit handling of multilingual sites),
* changes to CiviCRM’s translations portal easing translators’ work,
* multilingual demo installation for translators, picking up new translations “on the fly”,
* an automatic engine porting translation strings between CiviCRM releases.

:'''Mentor:''' Wes Morgan (subject to change)
:'''Skills Needed:''' PHP, CiviCRM Framework, MySQL, Joomla! Framework
:'''Difficulty:''' Hard

=====CiviCRM Integration: Multi-Organizational Access Control Lists=====
[http://civicrm.org/ CiviCRM] is an open source constituent relationship management system used by small and large NGOs and advocacy groups, some of them spanning across many smaller (and not-so-small) organizations and/or divided into subgroups, chapters, etc.

The goal of this project is to extend the current CiviCRM ACL capabilities to cover the needs of such multi-part organizations, as well as CiviCRM installations that span across many organizations (with various strengths of ties between them).

The new ACL features should include (but not be limited to):
* optional inheritance of access right between related organizations and related sub-organizations,
* creation and sane management of functional groups on various levels of the (sub-)organization graph (“volunteer coordinator for East US chapters of Org X”, “coordinator of campaign Y across all orgs”, etc.),
* scalability of the designed ACL system – performance-wise,
* scalability of the designed ACL system – manageability-wise.

:'''Mentor:''' Wes Morgan (subject to change)
:'''Skills Needed:''' PHP, CiviCRM Framework, MySQL, Joomla! Framework
:'''Difficulty:''' Hard

=====Improved Error Handling=====
Create a component that will handle standard errors (ex. 404) so that headers are sent for the error code, but the error is trapped and redirected from the error.php file back to Joomla!
where it can be handled on a normal webpage.

:'''Mentor:''' Wilco Jansen (subject to change)
:'''Skills Needed:''' PHP, Joomla! Framework
:'''Difficulty:''' Medium

=====Media Manager Improvements=====
The following improvements could be made to the current Joomla! Media Manager:
* Support content expiration (image/video) that allow user to set start – end date of each content which to be lived on site
**e.g. food image can be lived on site only 3 months, due to the license issue, so we need to take out the image and replace it with other default image or leave it blank
* Support user friendly input interface which allow user to complete content input in 1 screen (Text input, Multiple images/videos upload, Tagging, Mapping related content and so on)

:'''Mentor:''' Akarawuth Tamrareang (subject to change)
:'''Skills Needed:''' PHP, Javascript, Joomla! Framework
:'''Difficulty:''' Hard

=====Whiteboard/Wiki Component=====
Joomla comes with a few core components, and a Whiteboard/Wiki component would be a great addition to those. It would be a basic implementation of the feature with the following possible features:

* Provide a simple interface for editing (perhaps allowing multiple users to edit at once or locking down while under edit)
* Ability to restrict user access on posting
* Organize whiteboards
* Keep revisions in archive

:'''Mentor:''' Ashwin Date (subject to change)
:'''Skills Needed:''' PHP, Javascript, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Core Extensions Semantic and SEO Updates=====
The core extensions can be modified to produce semantic markup. The tables should be replaced withmore appropriate containers for the contents. This would not replace the need for template overrides, but rather make the default output stronger to build upon. The output should also be arranged to best suit the content in the majority of situations. Perhaps also a basic system reset CSS file would need to be developed to set some of the basic layout items, also to be easily disabled.

The core output cannot be replaced completely without causing many 1.5 templates to break. Therefore it would be necessary to
either have a legacy mode for templates or to automatically detect the template type (1.5 or 1.6) in order to provide the right output.

Modules can be defined in a template to have pretty much any name they wish. While this is great for template makers, it would be good to have at least some guidelines about naming modules. Module names like user1 and user2 are essentially useless semantically, and to administrators of a site. Some templates are designed for any module to fit in any position, but in general there are at least a handful that are designed with the menu, footer, and other aspects in mind. Perhaps Joomla can create some guidelines (not requirements) related to this.

:'''Mentor:''' Allan Walker (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Templates for Joomla 1.6=====
Each version of Joomla comes with a set of templates, and they are updated with each major release. 1.6 is currently in development, and will need a new set of templates. These templates should:

* Employ semantic markup
* Provide a fresh look
* Be flexible to accommodate all kinds of content
* Come with example core overrides, perhaps for major extensions as well
* Should have a light memory print
* Comply with accessibility standards
* Validate
* Be easily modified and built upon

:'''Mentor:''' Allan Walker (subject to change)
:'''Skills Needed:''' PHP, HTML, CSS, Joomla! Framework
:'''Difficulty:''' Medium

=====Administrator and Usability Improvements=====
There are many little improvements that would help with general usability and administration for Joomla users.

* Assigning modules in the Menu Manager
* Assigning links from Article Manager
* Copying templates
* Easily change Control Panel icons
* Improved Front Page article handling
* Improve internal mailing system and its notifications
* Make Control Panel in the menu a one click step, not hover then select
* Have the main tabs linked in case they are clicked, such as Content goes to Articles

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, Javascript, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Content Item Templates=====

Easy page layout template system so that editors can choose from a pre-defined range of layouts.
This could be useful when certain pages all require the Name, Date, Author name, photo in a certain area, tagline etc.
Content item templates could be defined, then saved and authors could then choose from this list, helping sites with larger article content to retain continuity throughout their areas of pages.

:'''Mentor:''' Allan Walker (subject to change)
:'''Skills:''' Joomla CMS framework, MVC, PHP 5.2, MySQL
:'''Difficulty:''' medium

=====XML DTDs and XML Schemas for all XML files used in Joomla=====

XML files are used in various places throughout Joomla. Historically, the installer XML files have had DTDs against which they can be validated. However, there are a number of known issues with these DTDs and there are other XML files used in Joomla that have never had DTDs written at all. Furthermore, DTDs can only catch certain classes of errors within XML files and we need to look beyond DTDs to look at XML Schemas to catch other classes of errors.

* Review all XML files used in Joomla and list them on the documentation wiki.
* Create a collection of test cases of XML files that will fail in Joomla and which should, therefore, fail to validate in some way.
* Where DTDs already exist, review, revise and update them as necessary.
* Create DTDs for those XML files that don't currently have one.
* Create patches for the core code (target 1.6?) to ensure that valid DTDs can be written for all XML files.
* All current DTDs force some XML elements to appear in a particular order which is neither enforced nor required by Joomla. If possible, solve this problem so that designers and developers can place those elements in arbitrary order in the XML and still have the XML files validate against the DTDs.
* Create XML Schemas for all XML files used in Joomla.
* Ensure that DTDs and XML Schemas are well commented and/or thoroughly documented.
* Write comprehensive documentation covering the process of validating an XML file against both DTDs and XML Schemas. Some documentation already exists that can be used as the basis for this.
* Expand the collection of test cases to include XML files that will not fail in Joomla but which may or may not fail to validate against the DTDs or XML Schemas.
* Ensure that the test case collection is properly documented so that changes to Joomla and/or the DTDs and XML Schemas can be properly tested.

:'''Mentor:''' Chris Davenport (subject to change)
:'''Skills:''' Joomla CMS framework, XML / DTD validation
:'''Difficulty:''' Medium

=====Alternate Component for Editing Articles=====
The idea is to have an component on admin side that allows articles to be edited based on the frontend navigation, Something similar to [http://thewebkitchen.co.uk/typo3temp/pics/a367ba3c04.jpg Typo3 admin]implementation (just 2 and 3 in the image).

:'''Mentor:''' Amit Kumar Singh (subject to change)
:'''Skills:''' Joomla CMS framework, MVC, PHP 5.2, MySQL
:'''Difficulty:''' medium

=====Magento eCommerce Platform integration into Joomla!=====
Magento is an actively developing award winning open source eCommerce platform. The idea is to develop a bridge between Magento and Joomla.
More info about Magento can be found from the following websites:
[http://www.magentocommerce.com/ Magento official website]
[http://demo.magentocommerce.com/ Magento online demo]
[http://www.magentocommerce.com/media/tour/magento-tour-store/view Store tour video]
[http://www.magentocommerce.com/media/tour/magento-tour-admin/view Admin tour video]
[http://www.infoworld.com/slideshow/2008/08/168-best_of_open_so-8.html Best of Open Source Enterprise Applications]

:'''Mentor:''' Not assigned yet
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework
:'''Difficulty:''' Hard

=====Xinha WYSIWYG editor for Joomla! frontend and backend editing=====
Xinha is a powerful WYSIWYG editor, which supports plugins. So administrator can customize their working environment and even write their own plugins.
The idea is to integrate Xinha into Joomla! with ability of editing content from frontend and backend. The editor environment must be configurable, output
HTML code must be W3C compliant, for that we will need also to implement [http://htmlpurifier.org/ HTMLPurifier] plugin into Xinha.

You can try [http://edo.webmaster.am/projects Xinha editor plugin demo] for Joomla! 1.5.
More info about Xinha can be found from the following websites:
[http://xinha.webfactional.com/ Xinha official website]
[http://xinha.raimundmeyer.de/x_examples/ext_example.html Xinha demo]
[http://xinha.webfactional.com/wiki/Plugins Currently available Xinha plugins]

:'''Mentor:''' Not assigned yet
:'''Skills Needed:''' PHP, JavaScript, Joomla! Framework
:'''Difficulty:''' Medium

=====Working copy of Joomla! live site=====
Usually administrators are working on their live site directly and sometimes they do mistakes as all people do. Usually the live site get's messed after extension installation/uninstallation process and re-configuration. The idea is to have a working copy of the live site and make changes to it, then if everything is okay after some testing, you can approve changes and the tool will synchronize changes to your live site.

Some of the steps, which will need to be done to complete this project:
* Develop a tool, which will create a working copy of the site
* Develop a tool, which will synchronize working copy with the live website
* Develop a diff tool, which will show not approved changes
* Interface in working copy to view not approved changes with possibility to reject or approve specified changes

:'''Mentor:''' Sam Moffatt (subject to change)
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework
:'''Difficulty:''' Medium to Hard

=====Elgg Platform integration into Joomla!=====
Elgg was providing an elegant and powerful solution for anyone who wants to create their own online community. Elgg is free and open source and powers all kinds of social networks - from education and business to martial arts and rugby. If you are looking for a professional social intranet or just want to run a site for your fishing club, Elgg is a great choice. The idea is to develop a bridge between elgg and Joomla.
More info about elgg can be found from the following websites:
[http://www.elgg.org/ elgg official website]
[http://community.elgg.org/ elgg community online ]
[http://docs.elgg.org/wiki/Main_Page elgg Documentation]

Some of the steps, which will need to be done to complete this project:
* synchronize user between elgg and Joomla!
* develop module for Joomla! to show Users Activity
* develop module for Joomla! to show Members photo from Elgg

:'''Mentor:''' Pisan Chueachatchai, Akarawuth Tamrareang (subject to change)
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework
:'''Difficulty:''' Medium

=====New Extension Install Manager=====
Update Systems presently doesn't have an easy to navigate structure for handling the large amount of information that is potentially available when a user wishes to install new extensions into their system backed from the update system. Updates are presented already and temporarily uninstalled items are also displayed as a technology demonstration of what can be achieved using the new system.

A completely new look extension install manager is required to help make meaning of the information that the update system exposes. In part this system should also expose information about existing installed extensions in the system (including any pending updates they might have) as well as new extensions that are available. Its purpose should be similar to the way that "Synaptic" works on Debian or Ubuntu operating systems.

The majority of the data loading framework is build already permitting the enterprising developer to focus primarily on interfacing with the installer system and building a useful user interface to make containing these extensions very easy.

Areas of further development involve research involving the development of a Firefox plugin (or similar) that stream lines installing Joomla! extensions from a web site perhaps similar to the way that Firefox is handled. This would involve developing a service that facilitates authenticated remote installation procedures.

:'''Mentor:''' Sam Moffatt (subject to change)
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework
:'''Difficulty:''' Medium

=====Update Server=====
With the development of the new infrastructure there is a need to create an independent update server to make a developer's life easier when installing creating extensions. The update server should in part offer a download facility where users can download directly from it via a front end Joomla! component as well as something that will generate XML files statically on the file system and dynamically dependent on the administrator's choice. The XML files should be generated in the defined format that already exists and should handle updating automatically.

Expanding on the system it should be able to push notifications out through an extensible plugin system as well as handle automatic mirroring of the files (again via plugins). An example of a notification plugin could be something that automatically updates the JED or posts a new article in a specific category with changelog information. An example of a mirror plugin could be something that automatically uploads files to a release on JoomlaCode, perhaps even creating the release automatically as well. The location of generated XML files should be configurable as well and may also be requested to be uploaded to external resources as well (e.g. a mirror server for the XML update files).

The application should make the most of new features introduced into Joomla! 1.6 such as the Forms API to provide plugin customisable interfaces to various systems.

An extension of this would be the provisioning of content plugins that handle the integration of download URL's and version numbers for packages that are handled through the system to allow Joomla! content items to interact with the system in a flexible manner.

Proxy functionality would also be desirable to have the update server function as a slave to other sites and permit updates through a proxy. This would also involve a method for mirroring the binary files onto the proxy server as well but has some interesting different functionality to the main project.

:'''Mentor:''' Sam Moffatt (subject to change)
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework
:'''Difficulty:''' Medium

=====Authentication Systems=====
This is a major project consistent of various subparts. It should be undertaken by someone with at least a basic understanding of how Joomla! operates and developing for Joomla!. This is not a good starter project. Students should show an interest in this area and be happy to work in an agile method with tighter deadline for individual projects to come together as a final assessable package. A combination of options might be selected but at least three should be considered.

This is still in moderate draft phase.

* Group Mapping Group Mappings is a feature that permits external groups to be mapped onto Joomla! groups when the user logs into the system. Implementation of the data retrieval aspect of this project isn't required however implementation of a user interface to control group mappings is required. The system should permit the administrator to designate that a specified group name string should map to a given user group. Optionally settings may be given priorities to enable mapping of "primary" groups to the user. This project is Joomla! 1.6 only and includes work on the new ACL system that permits multiple groups.

* LDAP Authentication Groups Discovery Tied in with group mapping the LDAP authentication plugin should then become capable of determining the groups that a user is a member of and reporting this back to the parent system. This will probably be in DN form which is why the group mapping application is useful.

* LDAP User Plugin Presently I have an LDAP user plugin that permits Joomla! to push users details into LDAP. Ideally this could be expanded to handle groups as a general improvement to the entire user subsystem. Extra user fields should also be populated some how as well. Ideally it should be made into a configurable so that mappings could be made arbitrarily however 'templates' for individual directory systems (MSAD, eDirectory, SunOne, OpenDirectory, plain OpenLDAP inetOrgPerson).

* LDAP ACL Backend This would permit ACL changes to be pushed into LDAP which can then be copied into different Joomla! sites periodically permitting centralised control as well as more generalised ACL systems to hook into Joomla!.

* Pluggable Authentication Requests Developers should be able to request authentication to occur and then be redirected back to where they are. This authentication system should be pluggable to permit different handlers to be implemented. For example a default plugin would be Joomla!'s Login Form however another authentication fall back might push you through SSO instead and then fall back to the login form.

* External SSO Authentication Hook Build an external authentication system that permits login hooks into the system outside of the primary site similar to how Moodle handles its authentication. This would aide non-obtrusive SSO authentication requests integrated with the above Pluggable Authentication Requests system without having to go through an entire potential request to Joomla!. This should be a lot more cut down than a full application load and would involve the development of a smaller application to handle this with a slightly different style to what is normally used and could be considered a 'harder' project than the rest.

:'''Mentor:''' Sam Moffatt (subject to change)
:'''Skills Needed:''' PHP, MySQL, JavaScript, Joomla! Framework, LDAP (for some).
:'''Difficulty:''' Medium

=====Adminlist library for Joomla! Developers=====
Many developers create new components every day all over the world. The idea is to develop a library for rendering lists of items in the administration panel (like standard lists of users/articles/categories/etc). It must handle all routine work of creating such lists for components.

It should work like a common form creator class. You set list of fields with their types (columns) and list of values (rows) or an SQL-query to fetch them.

The main features of the library should be:

* Different column types (at least text, link, edit link, publish, order, logical and date types).
* Inputs for data filtering.
* Ability to set columns from either the php array or the xml file (this to be discussed).
* Ajax support for the following tasks: publish/unpublish, order up/order down, save ordering, filtering, sorting by columns.
* Quick edit mode to change some data on fly without entering item’s edit page.

:'''Mentor:''' Oleg Nesterov
:'''Skills Needed:''' PHP5, OOP, MySQL, JavaScript, Ajax, and some base knowledge of Joomla! Framework
:'''Difficulty:''' Medium

=====Web Links Component Upgrades=====

Add a new feature that could expand on the basic web links feature to allow users to submit links and then rate them. It could emulate some of the main features of digg.
* Expand the submit links feature
* Provide a ranking functionality
* Produce modules
* Plugin to connect with each article written to be included in the ranking
* Ability to accept submissions from external sites or widgets

:'''Mentor:''' Mark Dexter (subject to change)
:'''Skills Needed:''' PHP, MySql, Joomla! Framework
:'''Difficulty:''' Medium

=====Make it easier to Extend Editors=====
Currently it is very difficult to extend TinyMCE and other editors by using JavaScript plugins that are available for them. Idea is to make this process easier by allowing Joomla plugins to extend editors. We already have something similar on WordPress backend, which allows us to easily extend the TinyMCE editor using WordPress plugins.

:'''Mentor:''' Amit Kumar Singh (subject to change)
:'''Skills:''' JavaScript, Joomla CMS framework, MVC, PHP 5.2
:'''Difficulty:''' Hard

=====Site Cloner=====
This project involves building a tool that will take an existing site (probably HTML but could be partially dynamically generated) and feature the ability to suck it into Joomla!, stripping the template as it goes and attempting to rebuild the navigation structure whilst also maintaining as much metadata as possible. This project requires exceptional programming skill, a deep knowledge of the Joomla! CMS, and someone with a knack for solving weird problems. An analogous module exists for Drupal in its "[http://drupal.org/project/import_html Import HTML]" and might serve as a good location for study of ideas and concepts.

:'''Mentor:''' Sam Moffatt (subject to change)
:'''Skills:''' Joomla CMS framework, MVC, PHP 5.2
:'''Difficulty:''' Very Hard

=====Typography Plug-in=====
''Introduction''

Typography (''Etymology: typos ⎯ type, graphos ⎯ written'') is the art and techniques of arranging type, type design, and modifying type glyphs ([http://en.wikipedia.org/wiki/Typography en.wikipedia.org/wiki/Typography]).

Typography is an important part of any text design. It makes texts look better, more sophisticated, and professional. It was a must for all books, newspapers, and other printed text sources at the times when computers did not exist or were not widely spread and the texts were set up by professionals only. Nowadays 99% of texts are created not by professionals and the quality of typography leaves much to be desired.

I agree with those who say that it’s just a small detail but details is something that makes things perfect. As a musician must play from music, a HTML coder must take into account typography rules of text formatting although in both cases most people may not notice any benefits.

At the age of content management systems most texts are set up by common users and the typography issue has become even more visible. This problem can be at least partially solved by involving automated typography scripts while preparing texts for displaying on a web page.

''Goal''

The goal is to create Joomla! CMS plug-in that would format texts correctly according to typography rules of different languages without any loss of page display speed.

The plug-in would be used to fix primes, opening and closing quotes, apostrophes; to fix dashes, and other punctuation; to insert spaces and correct special symbols such as Copyright, Registered, Trademark, and others; to fix parentheses, brackets, angle brackets, and guillemets; to format numbers; to add no-break symbols when necessary, and more. In addition it would be used to handle such issues as quotes within quotes, and others.

Here are two examples from [http://everything2.com/title/rules%20of%20typography everything2.com] to illustrate the way the correctly formatted text would look:

* En français: Einstein a (peut-être) dit : « J’adore 3,14, 298 000 — et 42 ! ».
* In English: Einstein said: “3.14, 298,000—and 42—are my all-time favourite numbers!”

As you can see, it’s not only a matter of replacing certain symbols with their ‘correct’ versions. Everything is much more complicated, I’d say it’s a challenge :)

''Previous Attempts''

There are quite a few typography plug-ins for Joomla! CMS but none of them is actually intended to format texts correctly. Each of those does certain tricks like inserting special symbols but none is even close to making the whole thing.

''Functional Requirements''

The functional requirements in brief can be as follows:

* The plug-in must adjust text formatting according to typography rules of supported languages.
* The plug-in must work really fast. Probably, regular expressions would work too slowly since there are pretty many typography rules and it would be necessary to create some lexical analyzer working without regular expressions.
* The plug-in must be scalable so that it must be relatively easy to add new rules for all or only for certain languages. Of course it’s not supposed to be done by end users but still it must be clear and not too complicated for programmers.

Open Issues:

* The plug-in might need cache functionality to speed up front-end pages displaying.

''Related Links''

* [http://en.wikipedia.org/wiki/Typography en.wikipedia.org/wiki/Typography]
* [http://everything2.com/title/rules%20of%20typography Rules of Typography]
* [http://webtypography.net/toc/ The Elements of Typographic Style Applied to the Web]
* [http://www.languagegeek.com/typography/apostrophes.html Apostrophes in Native Languages]
* [http://www.wpdfd.com/issues/23/typography/ Typography]

:'''Mentor:''' Andrey Mishenin
:'''Skills:''' PHP, OOP, Joomla! CMS Framework, experience with lexical analyzers coding would greatly help
:'''Difficulty:''' Hard

=====Page Title Tags Enhancement=====
Enhance title tags management in Joomla! for SEO purposes. This is first of all related to the content component that doesn’t handle titles perfectly at this time.

The idea is to allow forming titles basing on the following:

* Website name (optional)
* Current section and/or current category name (optional)
* Keywords for current section and/or current category (optional)
* Current article title

There should be ability to choose a separating symbol: “/”, “⎯”, etc. and the above mentioned items order in the title tag.

:'''Mentor:''' Andrey Mishenin
:'''Skills:''' PHP, OOP, MySQL, Joomla! CMS Framework
:'''Difficulty:''' Relatively easy

=====Joomla Multisites=====

Recently, i needed develop one Joomla portal where users could create own sites easy and fastly.
For it, i build one small Multisite Master Component that do database reply, create link to Joomla slave directory and more.
I have table as:
<title>site 1</title>
<description>Description of my site...</description>
<user_id>67</user_id>
<url>http://tom.yoursite.com</url>
<db_name>slavesite_tom</db_name>
<db_user>tom_userdb</db_user>
<db_pass>mypass</db_pass>
<pack_id>12</pack_id> (This indicates what slave directory and SQL for copy, i have other table with information for it).

In Joomla slave configuration.php I have implemented contructor function, where I load Master DB information, and I do comparation URL with it. After, i initialize JConfig fields with it (title = title of site, description = metadata, etc...)

So, i had good multisites system.

But i think that could to be better:
* Write new code for Master Component and configuration.php slave sites. (in my old version, i have one include to external php file in constructor, this php file rewrite JConfig variables)
* Creation slave site using only PHP (in my old system, using sh file, dont window server soport).
* Posible Front-Site component for user creator, that let you change template and other minors admin features.
* Soport multiple slaves type sites. Now only: reply DB and same files. We can more options: share users DB, dont share files (real copy of joomla slave directory), etc.
* And more?

:'''Mentor:''' none?
:'''Skills Needed:''' PHP, mySQL, Apache (lighttpd, etc) servers, Joomla! Framework
:'''Difficulty:''' Medium-Hard