CVE-2015-6513: SQL Injection

Q: Which deployments are affected?

J2Store (com_j2store) installations running a version before 3.1.7 are affected.

Q: Does exploitation require authentication or special access?

No. The vulnerability is remotely exploitable with no authentication required, and the attack vector is network-accessible.

Q: Which request parameters should be reviewed for exploitation attempts?

The affected index.php request parameters are sortby and manufacturer_ids[]. Look for suspicious SQL syntax or unexpected values supplied through either parameter.

Q: What should be done to remediate the issue?

Apply the available J2Store patch by updating to version 3.1.7 or later.

Published Aug 18, 2015

Updated

Multiple SQL injection vulnerabilities in the J2Store (comj2store) extension before 3.1.7 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) sortby or (2) manufacturerids[] parameter to index.php.

Affected Software

1 affected component

J2Store J2store Joomla\!<=3.1.6

Remediation

Patch Available

http://j2store.org/download-j2store/j2store-v3-3-1-7.html

Event History

Aug 18, 2015

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

Which deployments are affected?

J2Store (com_j2store) installations running a version before 3.1.7 are affected.

Does exploitation require authentication or special access?

No. The vulnerability is remotely exploitable with no authentication required, and the attack vector is network-accessible.

Which request parameters should be reviewed for exploitation attempts?

The affected index.php request parameters are sortby and manufacturer_ids[]. Look for suspicious SQL syntax or unexpected values supplied through either parameter.

What should be done to remediate the issue?

Apply the available J2Store patch by updating to version 3.1.7 or later.

CVE-2015-6513: SQL Injection

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or special access?

Which request parameters should be reviewed for exploitation attempts?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or special access?

Which request parameters should be reviewed for exploitation attempts?

What should be done to remediate the issue?