CVE-2014-0794

2014-01-2620:55:06

CWE-79

mitre

web.nvd.nist.gov

cve-2014-0794

sql injection

jv comment

com_jvcomment

joomla

remote authenticated users

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

Confidence

Low

EPSS

0.008

Percentile

82.2%

JSON

SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php.

Affected configurations

Nvd

Node

joomlacom_jvcommentMatch3.0.2

AND

joomlajoomla\!

VendorProductVersionCPE
joomlacom_jvcomment3.0.2cpe:2.3:a:joomla:com_jvcomment:3.0.2:*:*:*:*:*:*:*
joomlajoomla\!*cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*