vendor:
JE Ajax Event Calender
by:
altbta
8,8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: JE Ajax Event Calender
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: YES
Related CWE: N/A
CPE: a:joomlaextensions:je_ajax_event_calender
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Joomla! JE Ajax Event Calender Component SQL Injection Vulnerability
A SQL injection vulnerability exists in Joomla! JE Ajax Event Calender Component. An attacker can exploit this vulnerability to gain access to the database and extract sensitive information. The vulnerability is due to insufficient sanitization of user-supplied input in the 'event_id' parameter of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable script. This will allow the attacker to gain access to the database and extract sensitive information.
Mitigation:
Upgrade to the latest version of Joomla! JE Ajax Event Calender Component.
