PT-2020-7884
CVE-2015-7340
·
Published
2020-03-09
·
Updated
2020-03-10
Description by
CVSS 2.0
6.5
MediumMetricsAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions:
JEvents Joomla Component versions prior to 3.4.0 RC6
Description:
The issue is related to SQL Injection via the
evid variable in a Manage Events action. This allows for potential exploitation.Recommendations:
For versions prior to 3.4.0 RC6, update to version 3.4.0 RC6 or later to resolve the issue. As a temporary workaround, consider restricting access to the Manage Events action to minimize the risk of exploitation. Avoid using the
evid variable in the affected API endpoint until the issue is resolved.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾