PT-2020-16184 · Joomla · Pago Commerce

Published 2020-09-18 · Updated 2020-09-24 · CVE-2020-25751

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions paGO Commerce plugin version 2.5.9.0 for Joomla!

Description The issue allows SQL Injection via the "administrator/index.php?option=com pago&view=comments" API endpoint, specifically through the filter published parameter.

Recommendations For paGO Commerce plugin version 2.5.9.0, avoid using the filter published parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-25751

Affected Products

Pago Commerce

References · 4

• 🔥 https://exploit-db.com/exploits/48811 · Exploit
• https://osv.dev/vulnerability/CVE-2020-25751 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25751 · Security Note
• https://geekwire.eu/2020/09/14/joomla-pago-commerce-2-5-9-0-sql-injection-authenticated · Note