CVE-2009-1940

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the administrator panel of the com_users core component in Joomla! versions 1.5.x through 1.5.10 [1]. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors [1][2]. The vulnerability was fixed in Joomla 1.5.11, released on June 5, 2009 [1].

Exploitation

The attacker does not need authentication to exploit this vulnerability, as the administrator panel is accessible after login, but references indicate remote attackers can trigger it via unspecified vectors [1][2]. No detailed exploit steps are disclosed in available references, but the low complexity suggests a crafted URL or form field can inject malicious script.

Impact

Successful exploitation leads to arbitrary web script or HTML execution in the context of the affected administrator panel [1][2]. This can result in session hijacking, credential theft, or defacement within the Joomla administrative interface, potentially compromising the entire site.

Mitigation

Upgrade to Joomla 1.5.11 or later, which contains the fix for this moderate-priority XSS issue [1]. No workaround details are provided in the available references [1][2]. The Joomla project strongly recommends immediate upgrade [1].