Sorry, my english is very bad.

I Work with information security.
I found a flaw in all versions.
On my server, all errors (Error Reporting) and display errors are disabled in php.ini.
In addition, the Joomla settings are configured to not show error messages and found some errors
that are critical to the site.

Look:
Correct link: www.esecurity.com.br/.nsite2/social/sear...a%20Estrat%C3%A9gica

Injected characters
www.esecurity.com.br/.nsite2/social/search/field?FIELD_TITULO []=Intelig%C3%AAncia%20Estrat%C3%A9gica

Remember: In php.ini and configuration of Joomla all options are marked to not display errors

Hi Alan,

I visited that both links.
www.esecurity.com.br/.nsite2/social/sear...a%20Estrat%C3%A9gica
and
www.esecurity.com.br/.nsite2/social/search/field?FIELD_TITULO []=Intelig%C3%AAncia%20Estrat%C3%A9gica

always directed into this link: www.esecurity.com.br/index.php?option=co...t&view=article&id=41

i can't see any differences.

could you tell me what kind of flaw do you found? or there is error message (at server logs) ?

Hi,

Because this thread no respond for a long time. I assume has been resolved if not, you can respond this thread any times.

Regards,
Albert