CVE-2010-2255
SQL injection vulnerability in the BF Survey Pro (com_bfsurvey_pro) component before 1.3.1, BF Survey Pro Free (com_bfsurvey_profree) component 1.2.6, and BF Survey Basic component before 1.2 for Joomla! allows remote attackers to execute arbitrary SQL…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.00%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SQL injection vulnerability in the BF Survey Pro (com_bfsurvey_pro) component before 1.3.1, BF Survey Pro Free (com_bfsurvey_profree) component 1.2.6, and BF Survey Basic component before 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.00% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- tamlyncreative/com bfsurvey profree · tamlyncreative/com bfsurvey pro · tamlyncreative/com bfsurvey basic
- Source
- cve@mitre.org
References
- http://osvdb.org/61456
- http://packetstormsecurity.org/1001-exploits/joomlabfsurveypro-sql.txtExploit
- http://secunia.com/advisories/37868Vendor Advisory
- http://www.securityfocus.com/bid/37585Exploit
- http://www.tamlyncreative.com.au/software/forum/index.php?topic=641.0Exploit
- http://osvdb.org/61456
- http://packetstormsecurity.org/1001-exploits/joomlabfsurveypro-sql.txtExploit
- http://secunia.com/advisories/37868Vendor Advisory
- http://www.securityfocus.com/bid/37585Exploit
- http://www.tamlyncreative.com.au/software/forum/index.php?topic=641.0Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.