CVE-2015-7857: SQL Injection
Published Oct 29, 2015
·Updated
SQL injection vulnerability in the getListQuery function in administrator/components/comcontenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.
Affected Software
15 affected components
Joomla Joomla\!=3.2.0
Joomla Joomla\!=3.2.1
Joomla Joomla\!=3.2.2
Joomla Joomla\!=3.2.3
Joomla Joomla\!=3.2.4
Joomla Joomla\!=3.3.0
Joomla Joomla\!=3.3.1
Joomla Joomla\!=3.3.2
Joomla Joomla\!=3.3.3
Joomla Joomla\!=3.3.4
Joomla Joomla\!=3.4.0
Joomla Joomla\!=3.4.1
Joomla Joomla\!=3.4.2
Joomla Joomla\!=3.4.3
Joomla Joomla\!=3.4.4
Event History
Oct 29, 2015
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-7857?
CVE-2015-7857 has a high severity rating due to its potential for remote SQL injection attacks.
2
How do I fix CVE-2015-7857?
To fix CVE-2015-7857, update Joomla! to version 3.4.5 or later.
3
Who is affected by CVE-2015-7857?
CVE-2015-7857 affects all Joomla! versions from 3.2.0 to 3.4.4.
4
What kind of attacks can occur due to CVE-2015-7857?
CVE-2015-7857 allows remote attackers to execute arbitrary SQL commands, potentially compromising the Joomla! application.
5
Is there any workaround for CVE-2015-7857 before patching?
There are no reliable workarounds for CVE-2015-7857, so the best approach is to apply the security update as soon as possible.