CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.
Explanation of Vulnerability in Simple Terms
The Zoo extension for Joomla contains a SQL injection vulnerability that allows unauthenticated attackers to query the database directly. An attacker can extract sensitive data including user credentials, configuration details, and other stored information without needing to log in or interact with a user. This affects Zoo versions 1.0.0-4.1.63.
What an attacker can do
Extract sensitive data from the Joomla database, including user credentials and site configuration.
Potential impact on your site
User passwords, email addresses, and other database contents can be stolen without warning or detection.
Conditions required to exploit
Network access to the Joomla site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
