PT-2017-17856 · Joomla+1 · Smart Related Articles+1

Publicado 2017-04-13 · Atualizado 2017-04-20 · CVE-2017-7628

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla "Smart related articles" extension version 1.1

Description The issue concerns SQL injection in the dialog.php file of the "Smart related articles" extension for Joomla. An attacker must use the search cats variable in the POST method to exploit this vulnerability. The API endpoint involved is not explicitly mentioned, but the exploitation method involves sending a POST request with malicious input for the search cats variable.

Recommendations For Joomla "Smart related articles" extension version 1.1, consider disabling the dialog.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the search cats variable in POST requests to the affected endpoint.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-7628

Produtos afetados

Joomla!

Smart Related Articles

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-7628 · Nota de Segurança
• https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection · Nota
• https://extensions.joomla.org/extension/smart-related-articles · Nota
• https://osv.dev/vulnerability/CVE-2017-7628 · Aviso do Fabricante
• https://gist.github.com/anonymous/14576258b0e66bb25ca4b7ca1638e51f · Correção