CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Component JE Photo Gallery 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting malicious SQL code through the categoryid parameter. Attackers can send GET requests to index.php with crafted categoryid values in the com_jephotogallery component to execute arbitrary SQL queries and retrieve sensitive data like usernames and password hashes.
Explanation of Vulnerability in Simple Terms
JE Photo Gallery for Joomla contains a SQL injection vulnerability in versions 1.1 and earlier. An attacker can inject malicious SQL commands through unfiltered input, potentially reading or modifying the site's database. No authentication is required to exploit this vulnerability.
What an attacker can do
Read or modify the site's database by injecting SQL commands through the extension.
Potential impact on your site
Attackers can steal user data, modify content, or compromise the entire Joomla installation.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
