QwikSec

Security Database

CVE

CWE

Training

CVE-2015-7857

Published: Oct 29, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/

x_refsource_MISC

vdb-entry

x_refsource_BID

vdb-entry

x_refsource_SECTRACK

http://www.rapid7.com/db/modules/exploit/unix/webapp/joomla_contenthistory_sqli_rce

x_refsource_MISC

exploit

x_refsource_EXPLOIT-DB

http://packetstormsecurity.com/files/134494/Joomla-Content-History-SQL-Injection-Remote-Code-Execution.html

x_refsource_MISC

http://packetstormsecurity.com/files/134097/Joomla-3.44-SQL-Injection.html

x_refsource_MISC

http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.