CVE-2017-20275
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The PHP-Bridge component in Joomla! version 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter.
Risk Assessment
Attackers can access database information, including table and column names, which may lead to serious data security breaches.
Recommendation
It is recommended to update the PHP-Bridge component to the latest version and implement input filtering and validation to prevent SQL injection.
Original NVD description (English source)
Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_phpbridge&view=phpview parameters and inject SQL code in the id parameter to extract database information including table and column names.