PT-2020-7886 · Joomla · Jnews Joomla

Fábio Pires + 2 · Published 2020-03-09 · Updated 2020-03-10 · CVE-2015-7342

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: JNews Joomla Component versions prior to 8.5.0

Description: The issue allows SQL injection via several fields, including upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.

Recommendations: For versions prior to 8.5.0, update to version 8.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the upload thumbnail, Queue Search Field, Subscribers Search Field, and Newsletters Search Field to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-7342

Affected Products

Jnews Joomla

References · 3

• 🔥 https://labs.integrity.pt/advisories/cve-2015-7342 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7342 · Security Note
• https://t.me/cibsecurity/10382 · Telegram Post