CVE-2010-4272: Pulse Infotech Sponsor Wall lets attackers run database commands

The Sponsor Wall extension version 1.1 for Joomla can be tricked into running unwanted database instructions when a specially crafted request is sent to the catid field. This could let an attacker view, change, or delete data stored by your site. Apply the vendor's update or remove the extension until it is patched.

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

• http://packetstormsecurity.org/1011-exploits/joomlasponsorwall-sql.txt
• http://secunia.com/advisories/42072 Vendor Advisory
• http://www.exploit-db.com/exploits/15367 Exploit
• http://www.osvdb.org/68956
• http://www.securityfocus.com/bid/44571
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62915