#VU10332 SQL injection in Joomla! - CVE-2018-6376
Published: January 30, 2018 / Updated: February 12, 2018
Vulnerability identifier: #VU10332
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-6376
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Joomla!
Joomla!
Software vendor:
Joomla!
Joomla!
Description
The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Hathor postinstall message in Joomla Core com_admin component. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in web application database.
Successful exploitation of the vulnerability may allow an attacker to gain administrative access to vulnerable web application.
Remediation
Update to version 3.8.4.