CVE-2014-9102
Kunena < 3.0.6 - Authenticated SQL Injection via Array Parameter Index
Title source: llmDescription
Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrary SQL commands via the index value in an array parameter, as demonstrated by the topics[] parameter in an unfavorite action to index.php.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/68956
Exploit x_refsource_misc
http://packetstormsecurity.com/files/127683/Joomla-Kunena-Forum-3.0.5-SQL-Injection.html
Vendor Advisory x_refsource_confirm
http://www.kunena.org/docs/Kunena_3.0.6_Read_Me
Vendor Advisory x_refsource_confirm
http://www.kunena.org/blog/139-kunena-3-0-6-released
Scores
EPSS
0.0166
EPSS Percentile
74.2%
Details
CWE
CWE-89
Status
published
Products (1)
kunena/kunena
< 3.0.5
Published
Nov 26, 2014
Tracked Since
Feb 18, 2026