Vulnerability Description
Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter. Attackers can send GET requests to index.php with the option=com_flipwall&task=click&wallid parameter containing SQL injection payloads to extract sensitive database information.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pulseextensions | Flip Wall | 8.0 |
Related Weaknesses (CWE)
References
- http://pulseextensions.com/Product
- https://extensions.joomla.org/extensions/extension/ads-a-affiliates/sponsors/fliProduct
- https://www.exploit-db.com/exploits/42524ExploitVDB Entry
- https://www.vulncheck.com/advisories/joomla-component-flip-wall-sql-injectionThird Party Advisory
FAQ
What is CVE-2017-20265?
CVE-2017-20265 is a vulnerability with a CVSS score of 7.1 (HIGH). Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter....
How severe is CVE-2017-20265?
CVE-2017-20265 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-20265?
Check the references section above for vendor advisories and patch information. Affected products include: Pulseextensions Flip Wall.