PT-2017-14303 · Open Source Matters · Joomla!

Amir · Published 2017-10-28 · Updated 2017-11-25 · CVE-2017-15946

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions com tag component version 1.7.6 for Joomla!

Description A SQL injection issue is present in the tag parameter of the index.php file, which can be exploited using the GET request method.

Recommendations For com tag component version 1.7.6, consider restricting access to the tag parameter in the index.php file until a patch is available. Avoid using the tag parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-15946

Affected Products

Joomla!

References · 4

• 🔥 https://vulnerability-lab.com/get_content.php?id=2061 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-15946 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15946 · Vendor Advisory
• http://securityfocus.com/bid/101942 · Note