CVE-2019-9184

Опубликовано: 26 фев. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the product_option[] parameter.

Ссылки

https://andreiconache.me/j2store-plugin-3-3-6-sql-injection/
Third Party Advisory
https://www.exploit-db.com/exploits/46467/
Exploit
Third Party Advisory
VDB Entry
https://www.j2store.org/blog/general/security-update-for-j2store.html
Patch
Vendor Advisory
https://andreiconache.me/j2store-plugin-3-3-6-sql-injection/
Third Party Advisory
https://www.exploit-db.com/exploits/46467/
Exploit
Third Party Advisory
VDB Entry
https://www.j2store.org/blog/general/security-update-for-j2store.html
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:j2store:j2store:*:*:*:*:*:joomla\!:*:*

Версия от 3.3.0 (включая) до 3.3.7 (исключая)

EPSS

Процентиль: 96%

0.22529

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-3ww3-6whr-vv99