CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.
Explanation of Vulnerability in Simple Terms
JoomCCK extension for Joomla contains a SQL injection vulnerability that allows attackers to execute arbitrary SQL queries against the site database. The vulnerability exists in versions 1.0-6.4.0 and earlier. Successful exploitation could allow an attacker to read, modify, or delete database contents, potentially compromising user data and site integrity.
What an attacker can do
Execute arbitrary SQL commands against the Joomla database to read, modify, or delete data.
Potential impact on your site
Database contents (user credentials, posts, settings) could be exposed, modified, or deleted without authorization.
Conditions required to exploit
Network access to the vulnerable Joomla site; specific attack vector details are unavailable.
Key dates
External resources
Related vulnerabilities
