PT-2010-5520 · Joomla · Jextensions Je Auto

Drosophila + 1 · Published 2010-12-09 · Updated 2010-12-10 · CVE-2010-4517

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JExtensions JE Auto (com jeauto) component version 1.0 for Joomla!

Description The issue allows remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. This is achieved by exploiting the char parameter in an item action to "index.php".

Recommendations For version 1.0, consider disabling the component until a patch is available, or ensure that magic quotes gpc is enabled to mitigate the risk of SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-4517

Affected Products

Jextensions Je Auto

References · 3

• 🔥 https://exploit-db.com/exploits/15714 · Exploit
• 🔥 http://exploit-db.com/exploits/15714 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-4517 · Security Note