Joomla SQL-Injection Flaw Affects Millions of Websites (trustwave.com)

Posted by Soulskill on Sunday October 25, 2015 @02:31AM from the still-a-thing-in-2015 dept.

An anonymous reader writes: Joomla has just issued a patch that fixes a SQL-injection vulnerability discovered by a researcher at Trustwave SpiderLabs. The flaw allowed malicious users to extract a browser cookie assigned to a site's administrator, giving them access to restricted parts of the server. The flaw first appeared in Joomla 3.2, released in November, 2013. An estimated 2.8 million websites rely on Joomla. The Joomla team and the researcher who found the flaw recommend an immediate update to version 3.4.5.

1 of 120 comments (clear)

Min score:

Reason:

Sort:

Re:php frameworks by Anonymous Coward · 2015-10-25 02:44 · Score: 2, Insightful

Preventing SQL injection attacks is trivially easy with very modest understanding of what you're doing.
Suggesting that they ditch one technology for another as a cure-all makes you part of the problem. Rather than try and understand what is going on, you'd rather have a language and/or framework handed to you that promises to solve everything. It is this mindset that results in pants-on-head stupid bugs to reach production.