PT-2020-7466
CVE-2013-3932
·
تاريخ النشر
2020-01-02
·
تاريخ التحديث
2020-01-09
الوصف من
CVSS 2.0
6.5
متوسطةالمقاييسAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions:
Jomres (com jomres) versions prior to 7.3.1 for Joomla!
Description:
The issue allows remote authenticated users with the "Business Manager" permission to execute arbitrary SQL commands via the
id parameter in an editProfile action to "administrator/index.php". This is a SQL injection vulnerability.Recommendations:
For versions prior to 7.3.1, update to version 7.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the
editProfile action in the administrator/index.php file to minimize the risk of exploitation. Avoid using the id parameter in the affected API endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾