PT-2017-7260 · Open Source Matters · Joomla!

Bikramaditya Guha

+1

·

Publicado

2017-10-18

·

Atualizado

2020-07-30

·

CVE-2015-7714

CVSS v2.0

6.5

Média

VetorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions com rpl component versions prior to 8.9.5 for Joomla!
Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via various parameters in the administrator/index.php endpoint, including id, copy field in a data copy action, pshow in an update field action, css, tip, cat id, text search, plisting, or pwizard.
Recommendations For com rpl component versions prior to 8.9.5, update to version 8.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrator/index.php endpoint and limiting the use of the vulnerable parameters until the update is applied.

Exploit

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-7714

Produtos afetados

Joomla!