Dj Helpfularticles Extension For Joomla
Monthly
Unauthenticated stored cross-site scripting in the DJ-HelpfulArticles voting module for Joomla (affected versions 1.0.0 through 1.2.0) lets remote attackers plant persistent script in the site database through the client-supplied 'ip' field of the getDeny, getConfirm and getDenyReason com_ajax handlers, which store the submitted value verbatim rather than deriving it from the connection. The injected payload is later rendered without output escaping in the administrator backend 'Helpful articles' overview (views/items/tmpl/default.php), so it executes only when a logged-in administrator opens that page - a passive user-interaction prerequisite reflected in the assessed vector (UI:R, scope changed C:H/I:H). No public exploit code has been identified at time of analysis, and the vendor has released version 1.3.0 as the fixed release.
Unauthenticated stored cross-site scripting in the DJ-HelpfulArticles voting module for Joomla (affected versions 1.0.0 through 1.2.0) lets remote attackers plant persistent script in the site database through the client-supplied 'ip' field of the getDeny, getConfirm and getDenyReason com_ajax handlers, which store the submitted value verbatim rather than deriving it from the connection. The injected payload is later rendered without output escaping in the administrator backend 'Helpful articles' overview (views/items/tmpl/default.php), so it executes only when a logged-in administrator opens that page - a passive user-interaction prerequisite reflected in the assessed vector (UI:R, scope changed C:H/I:H). No public exploit code has been identified at time of analysis, and the vendor has released version 1.3.0 as the fixed release.