Joomla's Latest Release Fixes SQL Injection Flaw That Put 2.8 Million Sites at Risk

The makers of open-source content management software (CMS) Joomla have moved quickly to patch a hole that allowed cybercriminals to make SQL injection attacks that would give them full administrative access to millions of websites.

A posting on the Joomla website late last week announced version 3.4.5 of the platform, which specifically addressed the SQL injection vulnerability. It described the fix as a high priority aimed at preventing attackers from exploiting the bug, which affected Joomla 3.2 through 3.4.4.

A researcher at Trustwave SpiderLabs first discovered the issue, which essentially let third parties enter specially crafted input fields on Web pages using Joomla. This would then provide the ability to observe the behavior of a host sever. According to the blog, the potential danger was huge, given that Joomla is used by more than 2.8 million websites and owns more than 6 percent of the worldwide website CMS market.

SQL injections are not uncommon as a hacking technique, but in this case, cybercriminals would have been able to extract a cookie from a Joomla user by exposing a session ID and then loading it into another browser. Ars Technica reported that details about the code used to take advantage of the flaw had already been published to Metasploit, which is used not only by legitimate penetration testing experts, but members of the hacking community, as well.

Logging in as the administrator of a Joomla website would mean cybercriminals could do almost anything they wanted, Digital Journal observed, including block content, push out malware, delete pages on a site or even worse. Unlike some SQL injection attacks, the vulnerability on Joomla wasn’t necessarily that difficult or time-consuming to execute, which is why the release of the updated version will be so important to a number of website owners.

As Softpedia pointed out, Joomla’s SQL injection issue isn’t the only example of flaws opening up major risks within the CMS space. Just a few hours before the Joomla problem was discovered, makers of a similar open-source tool, Drupal, released an upgrade to deal with an open redirect vulnerability. No matter what you use to publish and manage Web content, staying current has never been more important.

Shane Schick

Writer & Editor

CISA Malware Next-Gen Analysis now available to public sector

2 min read - One of the main goals of the Cybersecurity and Infrastructure Security Agency (CISA) is to promote security collaboration across the public and private sectors. CISA firmly believes that partnerships and effective coordination are essential to maintaining critical infrastructure security and cyber resilience.In faithfulness to this mission, CISA is now offering the Malware Next-Generation Analysis program to businesses and other organizations. This service has been available to government and military workers since November 2023 but is now available to the private…

Social engineering in the era of generative AI: Predictions for 2024

5 min read - Breakthroughs in large language models (LLMs) are driving an arms race between cybersecurity and social engineering scammers. Here’s how it’s set to play out in 2024.For businesses, generative AI is both a curse and an opportunity. As enterprises race to adopt the technology, they also take on a whole new layer of cyber risk. The constant fear of missing out isn’t helping either. But it’s not just AI models themselves that cyber criminals are targeting. In a time when fakery…

Change Healthcare attack expected to exceed $1 billion in costs

3 min read - The impact of the recent Change Healthcare cyberattack is unprecedented — and so are the costs. Rick Pollack, President and CEO of the American Hospital Association, stated, “The Change Healthcare cyberattack is the most significant and consequential incident of its kind against the U.S. healthcare system in history.”In a recent earnings call, UnitedHealth Group, the parent company of Change Healthcare, speculated on the overall data breach costs. When all is said and done, the total tally may reach $1 billion…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from

CISA Malware Next-Gen Analysis now available to public sector

Social engineering in the era of generative AI: Predictions for 2024

Change Healthcare attack expected to exceed $1 billion in costs

Topic updates