Pascal Lohmann

A privilege escalation issue exists in the registration method of the Gridbox extension for Joomla. This flaw allows unauthenticated actors to register new accounts with administrative permissions by providing specific usergroup IDs.

File upload methods allow authenticated attackers to upload arbitrary files. This issue can lead to authenticated Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a remote machine, if combined with another flaw that allows the attacker to create the required account.

The photo viewer component allows unauthenticated attackers to perform an arbitrary file read, enabling them to view files on the system without authentication.