CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through multiple filter parameters. Attackers can inject malicious SQL code via the filter_type_id, filter_pid_id, and filter_search parameters in POST requests to extract sensitive database information including credentials and server details.
Explanation of Vulnerability in Simple Terms
Responsive Portfolio versions 1.6.1 and later contain a SQL injection vulnerability in database query handling. An attacker with low-level user privileges can inject malicious SQL commands to read or modify database contents. The vulnerability requires network access and low authentication privileges but no user interaction.
What an attacker can do
Read or modify database contents by injecting SQL commands into vulnerable queries.
Potential impact on your site
Database contents may be exposed or altered by authenticated attackers with low privileges.
Conditions required to exploit
Attacker must have low-level user account access to the application.
Key dates
External resources
Related vulnerabilities
