CVE-2010-4166

Name of the Vulnerable Software and Affected Versions Joomla! versions 1.5.x through 1.5.21

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the filter order parameter in a com weblinks category action to "index.php", the filter order Dir parameter in a com weblinks category action to "index.php", or the filter order Dir parameter in a com messages action to "administrator/index.php".

Recommendations For Joomla! versions 1.5.x through 1.5.21, update to version 1.5.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the com weblinks and com messages components until the update is applied. Avoid using the filter order and filter order Dir parameters in the affected API endpoints until the issue is resolved.