Two vulnerabilities have been discovered in the Real Estate Property component for Joomla, which can be exploited by malicious people to disclose potentially sensitive information and conduct SQL injection attacks.

1) Input passed to the "controller" parameter in index.php (when "option" is set to "com_properties") is not properly sanitised before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.

2) Input passed via the "aid" parameter to index.php (when "option" is set to "com_properties" and "task" is set to "agentlisting") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are confirmed in version 3.1.22-03. Prior versions may also be affected.

Solution
Update to version 3.1.0624 (released 2011-02-14).

Provided and/or discovered by
1) Chip D3 Bi0s
2) c4uR

Changelog
Further details available in Customer Area

Original Advisory
c4uR:
http://www.exploit-db.com/exploits/12136

Deep Links
Links available in Customer Area