high7.5Public exploit code
CVE-2014-4960
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla!
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Joomla! Component Youtube Gallery 4.1.7 - SQL Injection2014-07-16 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Joomlaboat | Com Youtubegallery | Versions 3.9.0, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 3.9.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/127497/Joomla-Youtube-Gallery-4.1.7-SQL-Injection.html
- http://www.exploit-db.com/exploits/34087
- http://www.securityfocus.com/bid/68676
- http://packetstormsecurity.com/files/127497/Joomla-Youtube-Gallery-4.1.7-SQL-Injection.html
- http://www.exploit-db.com/exploits/34087
- http://www.securityfocus.com/bid/68676