CVE-2010-0635
SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.06%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.06% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- jevents/jevents search plugin
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/38404Vendor Advisory
- http://www.jevents.net/forum/viewtopic.php?f=17&t=3910#p15526Patch
- http://www.securityfocus.com/bid/38050
- http://secunia.com/advisories/38404Vendor Advisory
- http://www.jevents.net/forum/viewtopic.php?f=17&t=3910#p15526Patch
- http://www.securityfocus.com/bid/38050
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.