Code injection in Joomla! HDW Player Component - #VU3442
Published: January 4, 2017
Vulnerability identifier: #VU3442
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: HDW Player
Affected software:
Joomla! HDW Player Component
Joomla! HDW Player Component
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient filtration of user-supplied input. A remote attacker can pass send specially crafted HTTP request and execute arbitrary PHP code on target system with privileges of the web server.
Successful exploitation of the vulnerability may allow complete compromise of vulnerable application and server.
Remediation
Update to version 3.2.2.