VulnerabilityAnalyzed

CVE-2017-20269

Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component URL path.

HIGH 8.8EPSS 0.33%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component URL path. Attackers can supply malicious SQL code in the kissgallery endpoint to execute arbitrary database queries and extract sensitive information.

CVSS 4.0: 8.8 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.33% probability · 26th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: terrywcarter/kissgallery
Source: disclosure@vulncheck.com

References

http://terrywcarter.com/Product
https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/kissgallery/Product
https://www.exploit-db.com/exploits/42494Exploit, VDB Entry
https://www.vulncheck.com/advisories/joomla-component-kissgallery-sql-injectionThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.