Sitelock Found High Priority Security Issue Joomla 3.5.1

Question

My server is running Sitelock Pro which has identified a high priority security vulnerability. I am using Joomla 3.5.1. They have reported the following as a potential CGI Generic SQL Injection Issue.

Using the GET HTTP method, SiteLock found that :

+ The following resources may be vulnerable to blind SQL injection : + The 'view' parameter of the /index.php CGI :

/index.php?password=&username=&task=user.login&return=aHR0cDovL2Fnc2hvd3 Nuc3cub3JnLmF1Lw%3d%3d&remember=yes&846aab23bf47149946862bda9334e253=1&a 3eed60704e56fd53c721c36000f958c=1&format=json&option=com_ajax&view=remin d)+or+(1=1

-------- output --------

HTTP/1.1 200 OK

-------- vs --------

HTTP/1.1 406 Not Acceptable

---

Any idea on what is causing this and how to fix it?

Answer 1

Really really simple solution and cant believe no one has said it. Upgrade to the latest version of Joomla. You are many versions behind

Answer 2

I don't think there's an issue there. The request is routed to com_ajax which will always return HTTP 200 when valid format is specified (as it is in this request). But it won't do anything, there's no module or plugin in the request to be called, so com_ajax will just return an empty result set, $results is null here, nothing was processed:

case 'json' :
        echo new JResponseJson($results, null, false, $input->get('ignoreMessages', true, 'bool'));

        break;