PT-2011-1957 · Jextensions · Je Story Submit

L0Rd Crusad3R · Published 2011-11-02 · Updated 2011-11-17 · CVE-2010-5022

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JExtensions JE Story Submit (com jesubmit) component version 1.4 for Joomla!

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the view parameter to the "index.php" API endpoint.

Recommendations For version 1.4, consider disabling the view parameter in the "index.php" endpoint until a patch is available. Restrict access to the JE Story Submit component to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-5022

Affected Products

Je Story Submit

References · 4

• 🔥 http://exploit-db.com/exploits/14054 · Exploit
• 🔥 https://exploit-db.com/exploits/14054 · Exploit
• 🔥 http://securityfocus.com/bid/41171 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-5022 · Security Note