CVE-2017-20252

Name of the Vulnerable Software and Affected Versions Joomla NextGen Editor version 2.1.0

Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL commands. This is achieved by sending GET requests to the 'index.php' endpoint with the parameters option=com nge and view=config, injecting malicious code into the plname parameter to extract sensitive database information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.