vendor:
Spinner 360
by:
Ihsan Sencan
8,8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Spinner 360
Affected Version From: 1.3.0
Affected Version To: 1.3.0
Patch Exists: NO
Related CWE: N/A
CPE: a:cmsplugin:spinner_360:1.3.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Win7 x64, Kali Linux x64
2017
Joomla! Component Spinner 360 v1.3.0 – SQL Injection
A SQL injection vulnerability exists in Joomla! Component Spinner 360 v1.3.0. An attacker can send a specially crafted HTTP request containing malicious SQL statements to the vulnerable application in order to gain access to unauthorized information or to manipulate data. The vulnerability is located in the 'Ihsan_Sencan' parameter of the '/spinner-360' page when processing a GET request method.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.
