PT-2016-4511 · Huge It · Huge It Catalog Extension

Larry W. Cashdollar + 1 · Publicado 2016-10-21 · Atualizado 2018-05-02 · CVE-2016-1000119

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huge IT catalog extension version 1.0.4

Description The issue concerns SQL injection (SQLi) and cross-site scripting (XSS) in the Huge IT catalog extension for Joomla. SQLi is a type of attack where an attacker injects malicious SQL code to manipulate the database, while XSS is an attack where an attacker injects malicious code into a website, which is then executed by the user's browser.

Recommendations For version 1.0.4, consider disabling the extension until a patch is available to prevent potential SQLi and XSS attacks. Restrict access to sensitive database queries and user input validation to minimize the risk of exploitation.

Exploit

Correção

XSS

SQL injection

Enumeração de Fraquezas

CWE-79

CWE-89

Identificadores relacionados

CVE-2016-1000119

Produtos afetados

Huge It Catalog Extension

Referências · 5

• 🔥 http://vapidlabs.com/advisory.php?v=167 · Exploit
• http://securityfocus.com/bid/92185 · Nota
• http://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/catalog · Nota
• https://osv.dev/vulnerability/CVE-2016-1000119 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000119 · Nota de Segurança