PT-2018-14006 · Joomla · Collection Factory

Ihsan Sencan · Published 2018-09-28 · Updated 2018-11-15 · CVE-2018-17383

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla! Collection Factory version 4.1.9

Description A SQL Injection issue exists in the Collection Factory component for Joomla!, which can be exploited via the filter order or filter order Dir parameter.

Recommendations For version 4.1.9, avoid using the filter order and filter order Dir parameters in the affected component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-17383

Affected Products

Collection Factory

References · 4

• 🔥 https://exploit-db.com/exploits/45474 · Exploit
• 🔥 http://packetstormsecurity.com/files/149530/Joomla-Collection-Factory-4.1.9-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17383 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17383 · Vendor Advisory