PT-2017-17856 · Joomla+1 · Smart Related Articles+1

Published 2017-04-13 · Updated 2017-04-20 · CVE-2017-7628

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla "Smart related articles" extension version 1.1

Description The issue concerns SQL injection in the dialog.php file of the "Smart related articles" extension for Joomla. An attacker must use the search cats variable in the POST method to exploit this vulnerability. The API endpoint involved is not explicitly mentioned, but the exploitation method involves sending a POST request with malicious input for the search cats variable.

Recommendations For Joomla "Smart related articles" extension version 1.1, consider disabling the dialog.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the search cats variable in POST requests to the affected endpoint.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-7628

Affected Products

Joomla!

Smart Related Articles

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-7628 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7628 · Vendor Advisory
• https://gist.github.com/anonymous/14576258b0e66bb25ca4b7ca1638e51f · Patch
• https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection · Note
• https://extensions.joomla.org/extension/smart-related-articles · Note