CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hdwplayersearch parameter. Attackers can submit POST requests with crafted SQL payloads in the hdwplayersearch parameter to extract sensitive database information from the hdwplayer_videos table.
Explanation of Vulnerability in Simple Terms
A SQL injection vulnerability in Hdwplayer com_hdwplayer allows unauthenticated attackers to query the database directly. The vulnerability exists in version 4.2 and requires only network access to exploit. An attacker can extract sensitive data including user credentials, configuration details, and other database contents.
What an attacker can do
Extract sensitive data from the site database, including user credentials and configuration information.
Potential impact on your site
Attackers can read all database contents without logging in, exposing user accounts, passwords, and private site data.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
