PT-2020-7466 · Joomla · Jomres
Jennifer Bornholt
·
Published
2020-01-02
·
Updated
2020-01-09
·
CVE-2013-3932
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Jomres (com jomres) versions prior to 7.3.1 for Joomla!
Description:
The issue allows remote authenticated users with the "Business Manager" permission to execute arbitrary SQL commands via the
id parameter in an editProfile action to "administrator/index.php". This is a SQL injection vulnerability.Recommendations:
For versions prior to 7.3.1, update to version 7.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the
editProfile action in the administrator/index.php file to minimize the risk of exploitation. Avoid using the id parameter in the affected API endpoint until the issue is resolved.Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jomres