Description
The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contact_id parameter to index2.php.
References
- 18361 third-party-advisory
- 16185 vdb-entry
- http://forge.joomla.org/sf/go/artf2950
- ADV-2006-0097 vdb-entry
- http://www.listerit.com/content/view/116/84/
- http://forum.joomla.org/index.php/topic%2C29031.0.html
- joomla-vcard-information-disclosure(24042) vdb-entry