Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2009-3434: Tupinambis component for Mambo/Joomla lets attackers run database commands

CVE-2009-3434 · published 17 years ago

Summary

The Tupinambis extension version 1.0 used in Mambo and Joomla sites can be tricked into executing unwanted database commands when a specially crafted 'proyecto' value is sent. This could let an outside user read, modify, or delete data on your website. Update to a patched version or remove the component until a fix is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
onestopjoomla	com_tupinambis	1.0 `cpe:2.3:a:onestopjoomla:com_tupinambis:1.0:::::::*`

Original advisory text

SQL injection vulnerability in the Tupinambis (com_tupinambis) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the proyecto parameter in a verproye...

References

http://packetstormsecurity.org/0909-exploits/mambojoomlatupinambis-sql.txt Exploit
http://secunia.com/advisories/36848 Vendor Advisory
http://www.securityfocus.com/bid/36511 Exploit
http://www.vupen.com/english/advisories/2009/2730 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/53454

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published28 Sep 2009

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2009-3434 · NVD

Track software like this

Free during beta