What the vulnerability does
01Description
A vulnerability was found in mrtnmtth joomla_mod_einsatz_stats up to 0.2. It has been classified as critical. This affects the function getStatsByType of the file helper.php. The manipulation of the argument year leads to sql injection. Upgrading to version 0.3 is able to address this issue. The identifier of the patch is 27c1b443cff45c81d9d7d926a74c76f8b6ffc6cb. It is recommended to upgrade the affected component. The identifier VDB-217653 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Joomla Einsatz Stats module contains a SQL injection vulnerability in its database queries. An attacker with low-level site access can inject malicious SQL code to read, modify, or delete database records. The vulnerability requires adjacent network access and low privileges but no user interaction. Patch status is unknown; contact the vendor for updates.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete database records via SQL injection.
Potential impact on your site
04Site Impact
Attackers with low-privilege accounts can compromise your site's database integrity and confidentiality.
Conditions required to exploit
05Prerequisites
Low-level Joomla user account and adjacent network access to the site.
Key dates
06Disclosure timeline
January 8, 2023
CVE published
August 6, 2024
Record updated
