PT-2017-7260 · Open Source Matters · Joomla!

Bikramaditya Guha + 1 · Published 2017-10-18 · Updated 2020-07-30 · CVE-2015-7714

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions com rpl component versions prior to 8.9.5 for Joomla!

Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via various parameters in the administrator/index.php endpoint, including id, copy field in a data copy action, pshow in an update field action, css, tip, cat id, text search, plisting, or pwizard.

Recommendations For com rpl component versions prior to 8.9.5, update to version 8.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrator/index.php endpoint and limiting the use of the vulnerable parameters until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-7714

Affected Products

Joomla!

References · 5

• 🔥 https://exploit-db.com/exploits/38527 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7714 · Security Note
• http://rpl.realtyna.com/change-logs/rpl7-changelog · Vendor Advisory
• http://packetstormsecurity.com/files/134066/Realtyna-RPL-8.9.2-SQL-Injection.html · Note
• http://zeroscience.mk/en/vulnerabilities/ZSL-2015-5272.php · Note