PT-2018-17273 · Joomla · Joomla! Pinterest Clone Social Pinboard

Ihsan Sencan · Publicado 2018-02-17 · Atualizado 2018-03-12 · CVE-2018-5987

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Joomla! Pinterest Clone Social Pinboard version 2.0

Description: A security issue exists in the Pinterest Clone Social Pinboard component for Joomla!, where an attacker can inject SQL code. This can be achieved through various parameters in different actions, including the pin id or user id parameter in a "task=getlikeinfo" action, the ends parameter in a "view=gift" action, the category parameter in a "view=home" action, the uid parameter in a "view=pindisplay" action, the searchVal parameter in a "view=search" action, or the uid parameter in a "view=likes" action.

Recommendations: For Joomla! Pinterest Clone Social Pinboard version 2.0, as a temporary workaround, consider restricting access to the affected actions, such as "task=getlikeinfo", "view=gift", "view=home", "view=pindisplay", "view=search", and "view=likes", until a patch is available. Avoid using the parameters pin id, user id, ends, category, uid, and searchVal in their respective actions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-5987

Produtos afetados

Joomla! Pinterest Clone Social Pinboard

Referências · 3

• 🔥 https://exploit-db.com/exploits/44131 · Exploit
• https://osv.dev/vulnerability/CVE-2018-5987 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5987 · Nota de Segurança