CVE-2017-20276
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Joomla! Component SIMGenealogy version 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries. Attackers can send GET requests to index.php with the parameters option=com_simgenealogy and view=latest, injecting malicious SQL in the type parameter to extract sensitive database information.
Risk Assessment
This vulnerability poses a serious risk to data security within the organization, allowing attackers to access confidential information in the database. This could lead to data loss, privacy breaches, and potential financial losses.
Recommendation
It is recommended to update the SIMGenealogy component to the latest version that addresses this vulnerability. Additionally, implementing input validation and monitoring logs for unauthorized access attempts is advisable.
Original NVD description (English source)
Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the type parameter. Attackers can send GET requests to index.php with the option=com_simgenealogy, view=latest parameters and inject malicious SQL in the type parameter to extract sensitive database information.