PT-2020-7466
CVE-2013-3932
·
Published
2020-01-02
·
Updated
2020-01-09
Description by
CVSS 2.0
6.5
MediumMetricsAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions:
Jomres (com jomres) versions prior to 7.3.1 for Joomla!
Description:
The issue allows remote authenticated users with the "Business Manager" permission to execute arbitrary SQL commands via the
id parameter in an editProfile action to "administrator/index.php". This is a SQL injection vulnerability.Recommendations:
For versions prior to 7.3.1, update to version 7.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the
editProfile action in the administrator/index.php file to minimize the risk of exploitation. Avoid using the id parameter in the affected API endpoint until the issue is resolved. Found an issue in the description? Have something to add? Feel free to write us 👾