joomla/joomla-cms — pull request #472 by juliopontes (2012-10-03 16:37:34+00:00)
Title: Checking article alias

The Joomla router allows site visitors to create fake URLs.

For example, adding index.php/component/content/article/1-write-your-message-here, where "1" is the ID of the article, will produce a fake URL. "write-your-mesage-here" can be changed by anyone to anything, including offensive words, and make it appear that the site owner/administrator has generated the URL pattern when that's not the case.

As another example, category URLs can also be manipulated. In Joomla 2.5's default sample data, the following URL (which is about Joomla) :
index.php/using-joomla/extensions/components/content-component/article-category-list/24-joomla

can be manipulated to:
http://www.ostraining.net/joomla/using-joomla/extensions/components/content-component/lets-use/24-wordpress

Note that, in the above example, both "article-category-list" and "joomla" have been manipulated.

Having such alternative links could be detrimental for SEO if a malicious user creates malicious URLs. Furthermore, a site's reputation could be tainted by a malicious link if it appears to be coming from the site itself.