CVE-2017-20279

Name of the Vulnerable Software and Affected Versions Joomla Payage version 2.05

Description An SQL injection allows unauthenticated attackers to manipulate database queries by injecting SQL code through the aid parameter. Attackers can send GET requests to the 'index.php' endpoint with malicious aid values in the make payment task to extract sensitive database information using boolean-based blind or time-based blind techniques. Boolean-based blind SQL injection is a method where the attacker asks the database true or false questions and determines the answer based on whether the page loads normally or returns an error. Time-based blind SQL injection relies on the database pausing its execution for a specified duration before responding if a condition is true.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.