by Kastro
Paper/Archive/CVE-2023-23753

CVE-2023-23753

vi-solutions Visforms Base Package for Joomla 3 — Extension - vi-solutions - Visforms Base Package for Joomla 3

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 56.5.565 × 2011.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it.

Affected

ProductAffectedFixed inSource
Visforms Base Package for Joomla 33.0.43.0.5CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

advisoryvi-solutions.de/en/announcements/867-security-announcement-cve-2023-23754writeupblog.asturhackers.es/sql-injection-en-visforms-base-package-for-joomla-3-0-5-cve-2023-23753