vendor:
Responsive Portfolio
by:
Özkan Mustafa Akkuş (AkkuS)
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Responsive Portfolio
Affected Version From: 1.6.1
Affected Version To: 1.6.1
Patch Exists: NO
Related CWE: N/A
CPE: a:joomla:responsive_portfolio:1.6.1
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Kali Linux
2018
Joomla! Component Responsive Portfolio 1.6.1 – ‘filter_order_Dir’ SQL Injection
An attacker can execute SQL commands through parameters that contain vulnerable. An authorized user can use the filtering feature and can fully authorize the database or other server informations. Parameters 'filter_type_id, filter_pid_id, filter_search' have the same vulnerable. An attacker can use boolean-based blind and error-based payloads to exploit the vulnerability.
Mitigation:
Input validation and sanitization should be done to prevent SQL injection attacks.
