PT-2017-14319 · Joomla · Com Ns Downloadshop

Ihsan Sencan · Published 2017-10-29 · Updated 2017-11-17 · CVE-2017-15965

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions com ns downloadshop version 2.2.6

Description The issue allows SQL Injection via the id parameter in an "invoice.create" action.

Recommendations For version 2.2.6, update to a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-15965

Affected Products

Com Ns Downloadshop

References · 5

• 🔥 https://exploit-db.com/exploits/43094 · Exploit
• 🔥 https://packetstormsecurity.com/files/144435/Joomla-NS-Download-Shop-2.2.6-SQL-Injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-15965 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15965 · Security Note
• http://securityfocus.com/bid/101624 · Note