CVE-2014-4960: SQL Injection
Published Jul 21, 2014
·Updated
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (comyoutubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.
Affected Software
22 affected components
Joomlaboat Com Youtubegallery Joomla\!=3.9.0
Joomlaboat Com Youtubegallery Joomla\!=3.9.2
Joomlaboat Com Youtubegallery Joomla\!=3.9.3
Joomlaboat Com Youtubegallery Joomla\!=3.9.4
Joomlaboat Com Youtubegallery Joomla\!=3.9.5
Joomlaboat Com Youtubegallery Joomla\!=3.9.6
Joomlaboat Com Youtubegallery Joomla\!=3.9.7
Joomlaboat Com Youtubegallery Joomla\!=3.9.8
Joomlaboat Com Youtubegallery Joomla\!=3.9.9
Joomlaboat Com Youtubegallery Joomla\!=4.0.0
Joomlaboat Com Youtubegallery Joomla\!=4.0.1
Joomlaboat Com Youtubegallery Joomla\!=4.0.2
Joomlaboat Com Youtubegallery Joomla\!=4.0.8
Joomlaboat Com Youtubegallery Joomla\!=4.0.9
Joomlaboat Com Youtubegallery Joomla\!=4.1.0
Joomlaboat Com Youtubegallery Joomla\!=4.1.1
Joomlaboat Com Youtubegallery Joomla\!=4.1.2
Joomlaboat Com Youtubegallery Joomla\!=4.1.3
Joomlaboat Com Youtubegallery Joomla\!=4.1.4
Joomlaboat Com Youtubegallery Joomla\!=4.1.5
Joomlaboat Com Youtubegallery Joomla\!=4.1.6
Joomlaboat Com Youtubegallery Joomla\!=4.1.7
Event History
Jul 21, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-4960?
The severity of CVE-2014-4960 is rated as high with a score of 7.5.
2
How do I fix CVE-2014-4960?
To fix CVE-2014-4960, upgrade the YouTube Gallery component to version 4.1.8 or later.
3
What kind of vulnerability is CVE-2014-4960?
CVE-2014-4960 is a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands.
4
Which Joomla! component is affected by CVE-2014-4960?
CVE-2014-4960 affects the YouTube Gallery (com_youtubegallery) component for Joomla!.
5
What parameters are vulnerable in CVE-2014-4960?
The vulnerable parameters in CVE-2014-4960 are listid and themeid in the index.php.