CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profile fields and POST parameters. Attackers can inject script payloads in profile information fields like Address that execute when users visit the profile, or submit SQL injection payloads via the phone_no parameter to the user_setting endpoint to manipulate database queries.
Explanation of Vulnerability in Simple Terms
The EkRishta Joomla extension versions 2.10 and later contain a SQL injection vulnerability in an unspecified component. An attacker can send a crafted request over the network to execute arbitrary SQL queries against the site's database without authentication. This allows reading, modifying, or deleting sensitive data including user credentials and site configuration.
What an attacker can do
Execute arbitrary SQL queries to read, modify, or delete database contents without authentication.
Potential impact on your site
Attackers can steal user passwords, modify site content, or disable the site by corrupting the database.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
