Description
SQL injection vulnerability in the BF Quiz (com_bfquiztrial) component before 1.3.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a bfquiztrial action to index.php.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Valentin Hoebel · pythonwebappsphp
https://www.exploit-db.com/exploits/12796
References (9)
Core 9
Core References
Exploit x_refsource_misc
http://xenuser.org/documents/security/joomla_com_bfquiz_sqli.txt
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/39960
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/58979
Exploit x_refsource_misc
http://packetstormsecurity.org/1005-exploits/joomla_com_bfquiz_sploit.py.txt
Exploit x_refsource_misc
http://www.packetstormsecurity.org/1005-exploits/joomlabfquiz-sql.txt
Patch x_refsource_confirm
http://www.tamlyncreative.com.au/software/forum/index.php?topic=729.0
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1272
Exploit vdb-entry
x_refsource_osvdb
http://osvdb.org/65001
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/40435
Scores
EPSS
0.0224
EPSS Percentile
84.6%
Details
CWE
CWE-89
Status
published
Products (1)
tamlyncreative/com_bfquiztrial
< 1.3.0
Published
Nov 02, 2011
Tracked Since
Feb 18, 2026