CVE-2015-7297

Description

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858.

Scores

Faiblesses (CWE)

• CWE-89

Références européennes

• ENISA EUVD · EUVD-2015-7226
• GCVE · GCVE-0-2015-7297

Configurations affectées (CPE NVD)

• cpe:2.3:a:joomla:joomla\!:3.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.2.2:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.2.3:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.2.4:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.3.1:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.3.2:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.3.3:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.3.4:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.4.1:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.4.2:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.4.3:*:*:*:*:*:*:*
• cpe:2.3:a:joomla:joomla\!:3.4.4:*:*:*:*:*:*:*

Produits affectés

Références

• https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/
• http://www.rapid7.com/db/modules/auxiliary/gather/joomla_contenthistory_sqli
• http://www.securityfocus.com/bid/77295
• http://www.securitytracker.com/id/1033950
• http://www.rapid7.com/db/modules/exploit/unix/webapp/joomla_contenthistory_sqli_rce
• https://www.exploit-db.com/exploits/38797/
• http://packetstormsecurity.com/files/134494/Joomla-Content-History-SQL-Injection-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/134097/Joomla-3.44-SQL-Injection.html
• http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html

Sources