CVE-2019-9184: SQL Injection

Q: Which deployments are affected?

J2Store plugin 3.x versions before 3.3.7 for Joomla! are affected. The available remediation is to update to version 3.3.7 or later.

Q: Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What access could an attacker gain through successful exploitation?

A remote attacker can execute arbitrary SQL commands through the product_option[] parameter. The CVSS impact ratings indicate high potential impact to confidentiality, integrity, and availability.

Published Feb 26, 2019

Updated

SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the productoption[] parameter.

Affected Software

1 affected component

J2Store J2store Joomla\!>=3.3.0<3.3.7

Remediation

Patch Available

https://www.j2store.org/blog/general/security-update-for-j2store.html

Event History

Feb 26, 2019

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via NVD·03:29 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are affected?

J2Store plugin 3.x versions before 3.3.7 for Joomla! are affected. The available remediation is to update to version 3.3.7 or later.

Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What access could an attacker gain through successful exploitation?

A remote attacker can execute arbitrary SQL commands through the product_option[] parameter. The CVSS impact ratings indicate high potential impact to confidentiality, integrity, and availability.

CVE-2019-9184: SQL Injection

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What access could an attacker gain through successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What access could an attacker gain through successful exploitation?